§12: latency-regression gate over the BenchmarkDotNet hot paths

[ivanball]

Summary

Ships the reopened #12 maturity lever (the 2026-07-15 re-score downgraded §12 M4 to 3 because performance-smoke was runs-clean only):

• The CI job now runs the hot-path suite with --job Short --exporters json (real measurements, still under a minute) instead of --job Dry.
• A new build/perfgate verifier (dependency-free console, same isolation pattern as build/facts) fails the job against the committed Tests/Performance/perf-baseline.json:
  • Per-benchmark allocation ceilings (deterministic across machines): 0 B/op for the cached IsSatisfiedBy path, 8000 for the recompile anti-pattern, 4500 for criteria composition.
  • A machine-independent ratio floor: the compiled-expression cache must stay at least 1000x faster than recompile-each-call (measured ~120,000x locally); if the cache breaks, the ratio collapses and the gate reds.
  • Rule-named benchmarks missing from the results fail the gate (no vacuous pass).
• Moving the numbers deliberately means updating the baseline in the same PR.

Verification

• Local Short run captured real numbers (0.37 ns / 44,486 ns / 858 ns; 0 / 5588 / 3040 B/op).
• perfgate green against those results; red on a seeded ceiling violation (exact benchmark + numbers in the message); reverted.
• The job rename does not touch any required-check name (verified against branch protection).

Backlog #12 updated: lever DONE, maturity 3->4 candidacy recorded for the next re-score.

🤖 Generated with Claude Code