feat(bench): absolute allocs/event ceiling gate (#302)

[trilamsr]

Closes #302.

Summary

Adds a hard absolute alloc-per-event ceiling gate complementing the existing
% delta gate. Wired into make bench-check (the CI step), so a PR that lands
above the per-event ceiling on any pattern-library detector fails closed.

• New: scripts/bench-allocs-check.sh runs every BenchmarkXxxDetector
  under ./bench/detectors/ at count=10 × 500ms, takes the median
  allocs/op, divides by the per-entry window size (1024), compares to the
  ceiling in scripts/bench-registry.sh::allocs_gate.
• Extended: scripts/bench-registry.sh gains an allocs_gate array with
  one row per detector (bench_name|window|ceiling_allocs_per_event).
• Wired: make bench-check now invokes both gates (% delta + absolute).
  A new standalone make bench-allocs-check target runs the new gate alone.
• Documented: bench/detectors/README.md gains a "Two gates" section
  describing how the hard ceiling and the soft % delta gate compose.

Why an absolute gate

make bench-check today gates against a committed bench-baseline.txt via
benchstat % delta. That catches relative regression but not absolute
breach: a PR that updates the baseline ALSO raises the ceiling implicitly,
and a reverted optimization can creep back above the prior floor without
showing up as a >10% delta from its own (post-revert) baseline.

The absolute ceiling lives in git diff scripts/bench-registry.sh —
any change to the ceiling is reviewable on the diff alone. Optimization PRs
must lower the ceiling to lock the win in; reverts cannot silently raise
it back. That is the ratchet semantic #302 asks for.

Initial ceilings (measured baseline + 1 slack, Apple M1 Max)

testing.B's allocs/op is hardware-invariant — same value on CI's
linux/amd64 runner — so the M1-captured numbers gate cleanly.

Detector	allocs/op	allocs/event	ceiling
pod_evicted	15635	15.27	16
xid_correlation	12699	12.40	13
hbm_ecc	1429	1.40	2
nccl_hang	4088	3.99	5
thermal_throttle	780	0.76	1
pcie_aer	524	0.51	1

NORTHSTAR is 2 allocs/event; pod_evicted / xid_correlation / nccl_hang are
the three above the bar. Per-detector optimization trackers will be filed
as follow-ups to drive the ratchet path down.

Test plan

• make bench-allocs-check locally → PASS (all six detectors below
  ceiling).
• Mutation test (red) — tightened HBM ceiling 2 → 1 in
  allocs_gate, re-ran: gate exit 1, BenchmarkHBMECCDetector allocs/event=1.3955 > ceiling=1 ... BREACH. Reverted.
• Fail-closed test — replaced a gated bench name with
  BenchmarkNonexistentDetector, re-ran: gate exit 2, "no measurement
  for gated bench". Reverted.
• make vet, make lint, pre-commit hooks → green.
• CI bench-check on linux/amd64 → confirm M1 ceilings hold (this PR's
  check run is the validation).

- New `make bench-allocs-check` (wired into `make bench-check`) enforces
  absolute allocs-per-event ceilings on every pattern-library detector;
  ratchets downward as optimization PRs land.

[trilamsr]

Independent Review: feat(bench): absolute allocs/event ceiling gate (#302)

Mutation Verification: PASS

• Tightened HBM ceiling 2→1 in scripts/bench-registry.sh
• Gate exited 1 with "BREACH" message (correct)
• Restored original; gate exited 0 with "PASS" (correct)
• ✓ Red/green cycle works as specified

Scope Alignment: PASS

Issue #302 asks for "ratchet gate"; PR delivers absolute ceiling with hard-fail on CI.

• Window size mismatch in issue (varied per detector 200-1024) vs PR implementation (uniform 1024)
• PR chose uniform 1024-event window per benchWindowSize const in detectors_bench_test.go
• All 6 detectors enumerated in allocs_gate array ✓
• Initial ceilings (measured + 1 slack) match PR body

CI Wiring: PASS

• make bench-check now invokes both scripts/bench-check-all.sh (% delta) + scripts/bench-allocs-check.sh (absolute)
• .github/workflows/ci.yml:144 runs make bench-check ✓
• Fail-closed on config error (exit 2) ✓

Dual-Gate Logic: SIMPLIFICATION OPPORTUNITY

PR gates on BOTH % delta AND absolute ceiling. Assessment:

• % delta gate (benchstat vs committed baseline) catches relative regression
• Absolute ceiling gate (hard-coded script) catches absolute breach
• Design question: issue A16: per-detector allocs/event bench + ratchet gate #302 asks for "ratchet" — absolute ceiling IS the ratchet. The % delta gate is now redundant/orthogonal.
  • Can optimize: drop % delta gate if absolute ceiling is the load-bearing control? Or keep both for belt-and-suspenders?
  • Current design is defensible (layers), but added complexity. Bias deletion: is % delta actually used for decision-making, or is it just advisory now?

Hardware Invariance Claim: UNVERIFIED

PR asserts "allocs/op is hardware-invariant" and M1 ceilings will hold on ubuntu-latest/amd64.

• Claim is sound in principle (Go's escape analysis is deterministic per AST)
• CI has not yet run this PR on amd64; baseline was M1-only
• Risk: if amd64 escape analysis differs (rare but possible), CI will flake
• Mitigation: this PR's own CI run will validate; no blocker

Minor: Over-Engineering Check

• scripts/bench-allocs-check.sh uses awk/grep for median extraction (portable)
• Handles 6 detectors correctly; scales to N
• Exit code semantics (0/1/2) clear ✓
• No refactoring needed; clean implementation

Findings

1. Dual-gate necessity unclear: The PR wires both % delta gate + absolute ceiling gate into make bench-check. Per A16: per-detector allocs/event bench + ratchet gate #302 ("ratchet gate"), the absolute ceiling IS the ratchet. Is % delta (benchstat vs baseline.txt) still a load-bearing decision point, or is it now just noise? Ask author: can we drop one gate, or do they serve separate purposes in your intent?

2. Hardware invariance unverified on CI: PR cites M1 Max baselines as "hardware-invariant" but CI (ubuntu-latest/amd64) has not yet validated. Go escape analysis is deterministic, so risk is low. This PR's CI check run itself is the validation gate — no blocker now.

Verdict

SHIP — mutation test passes, all 6 detectors gated, CI wiring correct, fail-closed semantics solid. Dual-gate trade-off is defensible. Let CI run validate amd64 parity.