bench: GitHub Actions CI — trust-layer checks, no-net gates, runner calibration

Closes the CI-reachable slice of the Phase 1 infra gaps:
- trust-layer job: cargo test + clippy -D warnings + fmt
- target-gates-no-net: fetches pinned targets (new targets/fetch.sh),
  regenerates + verifies corpora, runs 'just gates tokei'
  mechanically, and executes the bench workload inside a
  --network=none container (SPEC 3.1/10 no-net requirement)
- runner-calibration (informational): A/A + injection harness measures
  the shared runner's noise floor per run, evidence uploaded as an
  artifact — environments are judged empirically, not assumed
- perf-probe (informational): reports which perf event sources work

docs/infra.md maps each remaining hardware requirement (pinned cores,
governor/SMT control, separate-uid trust layer) to the bench-metal
self-hosted runner setup a human can complete in ~15 min.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/bench-runner/src/fingerprint.rs

@@ -38,9 +38,7 @@ impl EnvFingerprint {
         Self {
             kernel: read_trimmed("/proc/sys/kernel/osrelease"),
             cpu_model,
-            governor: read_trimmed(
-                "/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor",
-            ),
+            governor: read_trimmed("/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor"),
             smt: read_trimmed("/sys/devices/system/cpu/smt/active"),
             turbo: read_trimmed("/sys/devices/system/cpu/intel_pstate/no_turbo"),
             aslr: format!(