feat(perf,benchmark-infra): criterion bench harness + advisory CI workflows (SDD-120)

Implementation of SDD-120 §1-§8:

Bench harness (crates/chanora_audio/benches/):
- common.rs: deterministic synthetic audio (440 Hz sine, no RNG).
- realtime_capture.rs: bench_capture_alloc_count (dhat) +
  bench_capture_callback_wall_clock (criterion).
- opus_codec.rs: bench_opus_encode_latency + bench_opus_decode_latency
  (direct audiopus, not AudioHandler — SDD-120 §3 item 4).
- resampler.rs: bench_resampler_throughput across 44.1->48 /
  16->48 / 48->48 passthrough.

CI tooling (crates/chanora_audio/examples/):
- emit_baseline.rs: aggregates criterion estimates.json outputs
  into the SRS-217 baseline schema.
- compare_baseline.rs: applies SRS-219 tolerance, renders markdown
  table with 🟢/🟡/🔴 markers + yellow simpler-form realization per
  SDD-120 §8.

  Deviation from SDD-120 §2 / §5 / §7 placement: these tools live
  under examples/, not benches/ or src/bin/. Rationale: they must
  consume serde_json (a dev-only dep — production builds must not
  pull it). Cargo only resolves dev-dependencies for [[test]],
  [[bench]], and [[example]] targets; [[bin]] targets under
  src/bin/ see only regular [dependencies]. examples/ keeps the
  binaries out of the production dep tree while still giving them
  cargo run --example invocation. An SDD-120 amendment should
  reflect this.

Workflows (.github/workflows/):
- bench-advisory.yml: PR + push triggers; runs benches; posts a
  sticky PR comment via actions/github-script@v7; job status is
  always success (SRS-218 clause 4 — non-blocking).
- bench-baseline-update.yml: workflow_dispatch only; runs benches;
  opens PR via peter-evans/create-pull-request@v6 (sole writer of
  the SAD-089 baseline JSON).

Cargo.toml additions ([dev-dependencies] only — verified excluded
from --release builds): criterion 0.5, dhat 0.3, serde_json 1.

Source-code seam: minimal pub-but-#[doc(hidden)] bench_seam module
in chanora_audio (engine.rs + lib.rs re-export) so the criterion
bench harness can construct a CaptureState and drive
CaptureState::ingest without re-implementing the engine (SDD-120
§3). Non-iOS targets only — CaptureState itself is iOS-gated.

Initial baseline seed: crates/chanora_audio/benches/baselines/
x86_64-unknown-linux-gnu.json = {}. compare_baseline handles the
missing-baseline case gracefully and emits a 'no red markers'
report; the first manual dispatch of bench-baseline-update.yml
after merge establishes the real values.

Out of scope per SDD-120 §10: production telemetry export,
build-failing hard CI gate, multi-host benchmarking, IDE
integration, Dart-side bridge round-trip bench.

Verification:
- cargo check --workspace --all-targets: PASS.
- cargo bench --bench realtime_capture --no-run: PASS.
- cargo bench --bench opus_codec --no-run: PASS.
- cargo bench --bench resampler --no-run: PASS.
- cargo build --example emit_baseline --example compare_baseline
  -p chanora_audio: PASS.
- cargo test --workspace: 106 passed, 0 failed, 3 ignored — no
  regression from prior count.

crates/chanora_audio/Cargo.toml

@@ -90,6 +90,34 @@ tokio = { version = "1", features = ["sync", "rt", "macros", "time", "test-util"
 # Cross-platform recording Layer for the SDD-090 / DEC-027 privacy
 # invariant integration test (`tests/ptt_privacy.rs`).
 tracing-subscriber = { version = "0.3", features = ["registry"] }
+# SDD-120 §3 — criterion bench harness (realtime_capture / opus_codec /
+# resampler). `harness = false` per bench entry below disables the
+# default libtest harness so criterion can install its own.
+criterion = "0.5"
+# SDD-120 §3 item 1 — dhat is used as the global allocator inside
+# `benches/realtime_capture.rs` to count post-warmup heap allocations
+# on the realtime capture path. Dev-dep only — does NOT affect
+# production builds.
+dhat = "0.3"
+# SDD-120 §5 / §8 — JSON serialization for `emit_baseline` /
+# `compare_baseline` binaries that consume criterion's per-bench
+# `estimates.json` outputs and emit the SRS-217 baseline schema.
+serde_json = "1"
+
+[[bench]]
+name = "realtime_capture"
+harness = false
+path = "benches/realtime_capture.rs"
+
+[[bench]]
+name = "opus_codec"
+harness = false
+path = "benches/opus_codec.rs"
+
+[[bench]]
+name = "resampler"
+harness = false
+path = "benches/resampler.rs"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 # GNOME-on-Wayland Global Push-to-Talk uses the freedesktop