ci(makefile): wire bench-allocs-check into ci-full (#424)

Makefile

@@ -379,7 +379,15 @@ ci-fast: lint vet mod-verify attribute-namespace-check doc-check  ## Fast-feedba
 # back-compat alias so existing scripts, docs, and hooks invoking `make ci`
 # remain semantically unchanged. New callers should prefer the explicit
 # `ci-fast` (inner loop) vs `ci-full` (pre-PR) split per PRINCIPLES §10.
-ci-full: license-check generate-fixtures-check verdict-fixtures-check vet build-tags tidy-check mod-verify lint nccl-fr-rce-gate register-lint actionlint zizmor coverage-check ci-fuzz-nccl-fr govulncheck doc-check deprecation-check no-autoupdate-check build smoke-quickstart  ## Everything CI runs. Run before opening a PR.
+#
+# `bench-allocs-check` is included so the local pre-PR gate matches what CI
+# enforces in `verify-static` (which runs `make bench-check`, invoking the
+# same script). Adds ~80s on an M1 Max so wall-time budgets ~5m rather than
+# the historical ~2.5m; see PRINCIPLES.md §10 and follow-up issue #424 for
+# the ratchet path. We accept the wall-time hit because local `ci-full`
+# divergence from CI surfaces ceiling breaches only post-PR-open, which
+# defeats the per-PR enforcement intent of #302.
+ci-full: license-check generate-fixtures-check verdict-fixtures-check vet build-tags tidy-check mod-verify lint nccl-fr-rce-gate register-lint actionlint zizmor coverage-check ci-fuzz-nccl-fr govulncheck doc-check deprecation-check no-autoupdate-check build smoke-quickstart bench-allocs-check  ## Everything CI runs. Run before opening a PR.
 
 ci: ci-full  ## Back-compat alias for `ci-full`. Existing scripts and `make ci` invocations keep working unchanged.
 

PRINCIPLES.md

@@ -107,7 +107,7 @@ A test suite that takes a minute and runs every commit beats a test suite that t
 The inner loop is split into two budgets so the 60-second ceiling stays honest as the project grows:
 
 - **`make ci-fast` must complete in under 60 seconds on a developer laptop.** Today it's ~30s. This is the fast-feedback subset (lint, vet, mod-verify, attribute-namespace-check, doc-check) — the gates that catch the most defects per second, runnable on every save.
-- **`make ci-full` is the full pre-PR gate** (everything CI enforces: tests under race + coverage, fuzz, build, govulncheck, zizmor, actionlint, …). Today it's ~2.5m. Run it before opening a PR. `make ci` remains as a back-compat alias.
+- **`make ci-full` is the full pre-PR gate** (everything CI enforces: tests under race + coverage, fuzz, build, govulncheck, zizmor, actionlint, bench allocs ceiling, …). Today it's ~5m on an M1 Max, dominated by `coverage-check`, `build`, and `bench-allocs-check` (~80s for the per-detector benches at `count=10 × 500ms`). Run it before opening a PR. `make ci` remains as a back-compat alias.
 - Race detector on by default for unit tests.
 - Integration tests gated behind `//go:build integration`; skipped when hardware isn't present.
 - Benchmarks are advisory, not gate-keeping. Slow CI burns trust.