bench: one-pass release evidence with lower-noise engine comparisons

[chh-ay]

Scope

Make the performance evidence trustworthy and capturable for 0.5.0. Bench tooling and the evidence renderer only; no published package changes. Part of #59. Stacked on #71 (base feat/array-arithmetic).

Problems

1. The page mixed capture vintages: render and data from July (47f1643), formula and XLSX from October. Each artifact's provenance stamp required a clean tree, but every capture writes a tracked artifact, so only the first capture of a session could stamp clean.
2. "20 runs did not finish" gave no cause.
3. The default-vs-full "paired median ratio" for identical work spanned 0.38–3.51 (p10–p90): each sample was one cold 1–3 ms fixture run.
4. 0.5.0 work had no evidence: packed bulk loads, CSV import, large undo, paged residency.
5. The documented regression check could not pass: the committed baseline pins harness file hashes and the runner (browser, Bun, Node, kernel), which have all changed.

Change

• bench:release captures every artifact the page needs in one pass on a clean tree; capture outputs no longer count as dirty, so the whole set shares one commit. It ends by re-recording the machine- and harness-pinned regression baseline. It refuses a dirty tree and stops at the first failure.
• One capture header for the page; mixed commits are flagged with a per-artifact table instead of hidden.
• Render failures name engine, size, step, and error. The 20 failures are upstream: Handsontable 18 remove_row at 1,000,000 rows overflows the call stack in its own DataMap.filterData.
• Engine comparison samples now warm up and aggregate ≥50 ms of repeated runs. Identical-work spread drops from 8.99× to 1.59× (p90/p10); rows above 1.5× are marked unsupported.
• New "Core write path" section: packed 1M-cell setBlock, detailed-capture block, 200k×10 CSV import, 500k-cell clear + undo, paged revisit residency, 10k-row bridge insert, each with correctness checkpoints.
• New "XLSX codec" section comparing the current codec with the pre-0.5.0 codec checkout.
• The analysis-engine capture renders on its own when the paired capture is missing.
• README and hints use machine-neutral guidance (idle machine, one pinned CPU).

Verification

• bun test bench/test: 101 pass. bench:release:smoke writes 5 stamp-verified artifacts from one clean commit.
• Layer gates: build, docs:check, api:check, typecheck, lint pass; packages 869 pass / 6 skip / 0 fail; Rust 147 / 223 pass.
• The committed evidence page still shows the old artifacts as pending or mixed; the release capture on the final tree fills them in.

[chh-ay]

Landed on develop in the 0.5.0 release squash: #112 (55cfa82).