feat(perf,benchmark-infra): criterion bench harness + advisory CI workflows (SDD-120)

Implementation of SDD-120 §1-§8:

Bench harness (crates/chanora_audio/benches/):
- common.rs: deterministic synthetic audio (440 Hz sine, no RNG).
- realtime_capture.rs: bench_capture_alloc_count (dhat) +
  bench_capture_callback_wall_clock (criterion).
- opus_codec.rs: bench_opus_encode_latency + bench_opus_decode_latency
  (direct audiopus, not AudioHandler — SDD-120 §3 item 4).
- resampler.rs: bench_resampler_throughput across 44.1->48 /
  16->48 / 48->48 passthrough.

CI tooling (crates/chanora_audio/examples/):
- emit_baseline.rs: aggregates criterion estimates.json outputs
  into the SRS-217 baseline schema.
- compare_baseline.rs: applies SRS-219 tolerance, renders markdown
  table with 🟢/🟡/🔴 markers + yellow simpler-form realization per
  SDD-120 §8.

  Deviation from SDD-120 §2 / §5 / §7 placement: these tools live
  under examples/, not benches/ or src/bin/. Rationale: they must
  consume serde_json (a dev-only dep — production builds must not
  pull it). Cargo only resolves dev-dependencies for [[test]],
  [[bench]], and [[example]] targets; [[bin]] targets under
  src/bin/ see only regular [dependencies]. examples/ keeps the
  binaries out of the production dep tree while still giving them
  cargo run --example invocation. An SDD-120 amendment should
  reflect this.

Workflows (.github/workflows/):
- bench-advisory.yml: PR + push triggers; runs benches; posts a
  sticky PR comment via actions/github-script@v7; job status is
  always success (SRS-218 clause 4 — non-blocking).
- bench-baseline-update.yml: workflow_dispatch only; runs benches;
  opens PR via peter-evans/create-pull-request@v6 (sole writer of
  the SAD-089 baseline JSON).

Cargo.toml additions ([dev-dependencies] only — verified excluded
from --release builds): criterion 0.5, dhat 0.3, serde_json 1.

Source-code seam: minimal pub-but-#[doc(hidden)] bench_seam module
in chanora_audio (engine.rs + lib.rs re-export) so the criterion
bench harness can construct a CaptureState and drive
CaptureState::ingest without re-implementing the engine (SDD-120
§3). Non-iOS targets only — CaptureState itself is iOS-gated.

Initial baseline seed: crates/chanora_audio/benches/baselines/
x86_64-unknown-linux-gnu.json = {}. compare_baseline handles the
missing-baseline case gracefully and emits a 'no red markers'
report; the first manual dispatch of bench-baseline-update.yml
after merge establishes the real values.

Out of scope per SDD-120 §10: production telemetry export,
build-failing hard CI gate, multi-host benchmarking, IDE
integration, Dart-side bridge round-trip bench.

Verification:
- cargo check --workspace --all-targets: PASS.
- cargo bench --bench realtime_capture --no-run: PASS.
- cargo bench --bench opus_codec --no-run: PASS.
- cargo bench --bench resampler --no-run: PASS.
- cargo build --example emit_baseline --example compare_baseline
  -p chanora_audio: PASS.
- cargo test --workspace: 106 passed, 0 failed, 3 ignored — no
  regression from prior count.

crates/chanora_audio/benches/realtime_capture.rs

@@ -0,0 +1,118 @@
+// SDD-120 §3 items 1-2 — realtime capture bench harness.
+//
+// - `bench_capture_alloc_count`: dhat-backed heap-allocation count
+//   across 1000 post-warmup `CaptureState::ingest` calls. Realizes
+//   the SRS-219 clause-a zero-allocation invariant. Local-developer
+//   surface additionally asserts that the post-warmup count is 0
+//   so a regression hard-fails locally; the CI advisory comparator
+//   in `compare_baseline.rs` carries the same `tolerance = 0` rule
+//   independently.
+// - `bench_capture_callback_wall_clock`: criterion default-warmup
+//   wall-clock bench of `ingest` on the same synthetic buffer.
+//
+// dhat is invasive — it replaces the global allocator for the
+// whole bench binary, but only this bench binary; production
+// builds and other benches are unaffected per Cargo's per-bench
+// compilation model.
+
+#[global_allocator]
+static ALLOC: dhat::Alloc = dhat::Alloc;
+
+use chanora_audio::bench_seam::CaptureBenchHandle;
+use criterion::{black_box, criterion_group, criterion_main, Criterion};
+
+mod common;
+use common::{synthetic_capture_buffer, FRAME_SAMPLES};
+
+fn bench_capture_alloc_count(c: &mut Criterion) {
+    // Build the dhat profiler in test mode so it is process-local
+    // and does not write a JSON heap-dump file. Held for the
+    // duration of this bench function.
+    let _profiler = dhat::Profiler::builder().testing().build();
+
+    let mut handle = CaptureBenchHandle::new(48_000, 1);
+    let buf = synthetic_capture_buffer(FRAME_SAMPLES, 1);
+
+    // 100-call warm-up to prime first-call allocations (ring
+    // growth, opus encoder lazy state, mono_scratch / pcm_accum
+    // capacity). SDD-120 §3 item 1.
+    for _ in 0..100 {
+        handle.ingest_f32(&buf);
+    }
+
+    let stats_warm = dhat::HeapStats::get();
+    let blocks_warm = stats_warm.total_blocks;
+
+    // 1000 post-warmup calls — measurement window.
+    for _ in 0..1000 {
+        handle.ingest_f32(&buf);
+    }
+
+    let stats_final = dhat::HeapStats::get();
+    let blocks_final = stats_final.total_blocks;
+    let delta = blocks_final - blocks_warm;
+
+    // Local-developer surface: hard-fail on any regression.
+    // The CI advisory comparator carries the same rule with a
+    // markdown 🔴 marker on regression instead of a panic.
+    assert_eq!(
+        delta, 0,
+        "post-warmup heap allocation regression: {} blocks (SRS-219 clause a)",
+        delta
+    );
+
+    // Register the metric value with criterion so it appears in
+    // `target/criterion/.../estimates.json` for the §5 emitter to
+    // pick up. We bench a no-op closure here because the actual
+    // measurement is the delta computed above; criterion's
+    // function-time-mean is uninteresting for an alloc-count
+    // metric. The §5 emitter reads the `capture_alloc_count`
+    // metric value out of band via a sidecar file written below.
+    c.bench_function("capture_alloc_count", |b| {
+        b.iter(|| {
+            black_box(delta);
+        });
+    });
+
+    // Sidecar file for §5 emit_baseline: criterion's own
+    // estimates.json carries the no-op closure timing, NOT the
+    // alloc count, so we write the canonical alloc-count value
+    // here and the emitter reads it directly.
+    if let Ok(dir) = std::env::var("CARGO_TARGET_DIR")
+        .map(std::path::PathBuf::from)
+        .or_else(|_| {
+            std::env::current_dir().map(|d| d.join("target"))
+        })
+    {
+        let path = dir.join("criterion").join("capture_alloc_count.sidecar");
+        if let Some(parent) = path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let _ = std::fs::write(&path, format!("{}", delta));
+    }
+}
+
+fn bench_capture_callback_wall_clock(c: &mut Criterion) {
+    let mut handle = CaptureBenchHandle::new(48_000, 1);
+    let buf = synthetic_capture_buffer(FRAME_SAMPLES, 1);
+
+    // Pre-warm so first-call allocations do not skew the
+    // measurement window (criterion's default warmup is 3 s which
+    // is more than enough; this loop is belt-and-braces).
+    for _ in 0..100 {
+        handle.ingest_f32(&buf);
+    }
+
+    c.bench_function("capture_callback_wall_clock", |b| {
+        b.iter(|| {
+            handle.ingest_f32(black_box(&buf));
+        });
+    });
+}
+
+criterion_group!(
+    realtime_capture,
+    bench_capture_alloc_count,
+    bench_capture_callback_wall_clock
+);
+criterion_main!(realtime_capture);