[Fix] (Bench, Trace, CI): let only the profile answer for itself, name an unreadable profile, and describe the CI step by the mechanism the tree has

- The verified-profile guard read the process environment as well as the profile: the test ran
  after the source, so PROFILE_VERIFIED=1 exported in an operator's shell re-opened the fail-open
  hole for every profile that says nothing. Both scripts now set PROFILE_VERIFIED=0 immediately
  before sourcing, so the file is the only thing that can answer.
- A --device path that cannot be sourced was diagnosed as an unverified profile, because both
  scripts cd to their own directory first and neither checked readability. The path is now also
  tried relative to the directory the script was invoked from (which is what a repo-root-relative
  --device means), and an unreadable one is reported as unreadable, naming both places tried.
- Verified: exported PROFILE_VERIFIED=1 + an unverified profile -> rc 2; exported 1 + a profile
  with no key -> rc 2; a repo-root-relative path -> resolved, then refused for its own reason;
  a missing file -> "cannot read the device profile"; odinlite.env -> past the guard;
  --allow-unverified-profile -> the three warnings, then proceeds.
- test.yml's new step described a mechanism the tree does not have. G6's and G10's entries are
  registered in the pull build too - they must be, for G2's name-for-name comparison - and skip
  inside their bodies. The step's value is unchanged and its comment now says the true thing: the
  `test` job runs those names as a column of skips, and this is the first CI job that unpacks a
  build which compiled the assertions.
- trace_benchmark takes the wall baseline before the CPU baseline, the order OnFrameBoundary
  already reads them in, so frame 0 stops reporting a CPU delta biased upward against its own
  wall delta; and it includes <time.h> rather than <ctime> for the POSIX names it uses.

android-plugin/app/src/trace/cpp/trace_benchmark.cpp

@@ -8,8 +8,14 @@
 // CLOCK_THREAD_CPUTIME_ID is POSIX and present on Linux and on every Android API this replays
 // on; the guard exists so the desktop CLI still builds where it is not, and so that "no CPU
 // series" is a compile-time fact rather than a silently-zero column.
+//
+// <time.h>, not <ctime>: clock_gettime, CLOCK_THREAD_CPUTIME_ID and struct timespec are POSIX
+// names, and only <time.h> is required to put them at global scope - <ctime> guarantees the C++
+// subset in namespace std and leaves the rest to the implementation. glibc and bionic both happen
+// to provide them either way; this file is built for both by two different toolchains, so it asks
+// for the header that actually promises what it uses.
 #if defined(__unix__) || defined(__linux__) || defined(__ANDROID__) || defined(__APPLE__)
-#include <ctime>
+#include <time.h>
 #define MOBILEGL_TRACE_HAVE_THREAD_CPU_CLOCK 1
 #else
 #define MOBILEGL_TRACE_HAVE_THREAD_CPU_CLOCK 0
@@ -78,12 +84,17 @@ void Begin(bool finishEachFrame) {
     gFrameMs.reserve(kFrameReserve);
     gFrameCpuMs.clear();
     gFrameCpuMs.reserve(kFrameReserve);
-    gLastBoundaryCpuMs = ThreadCpuMs();
     gFinishEachFrame = finishEachFrame;
     gResolvedGlFinish = false;
     gGlFinish = nullptr;
+    // Wall baseline FIRST, CPU baseline second - the same order OnFrameBoundary reads them in,
+    // and for the same reason. Frame 0's CPU interval then sits strictly inside its wall interval,
+    // so whatever this function costs between the two readings lands in the wall number where it
+    // can be seen, instead of inflating the CPU number where it cannot. Taken the other way round
+    // (as this was), frame 0 alone reported a CPU delta biased upward against its own wall delta.
     gStart = Clock::now();
     gLastBoundary = gStart;
+    gLastBoundaryCpuMs = ThreadCpuMs();
     gEnabled = true;
 }