bench: GitHub Actions CI — trust-layer checks, no-net gates, runner calibration

Closes the CI-reachable slice of the Phase 1 infra gaps:
- trust-layer job: cargo test + clippy -D warnings + fmt
- target-gates-no-net: fetches pinned targets (new targets/fetch.sh),
  regenerates + verifies corpora, runs 'just gates tokei'
  mechanically, and executes the bench workload inside a
  --network=none container (SPEC 3.1/10 no-net requirement)
- runner-calibration (informational): A/A + injection harness measures
  the shared runner's noise floor per run, evidence uploaded as an
  artifact — environments are judged empirically, not assumed
- perf-probe (informational): reports which perf event sources work

docs/infra.md maps each remaining hardware requirement (pinned cores,
governor/SMT control, separate-uid trust layer) to the bench-metal
self-hosted runner setup a human can complete in ~15 min.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/bench-runner/src/lib.rs

@@ -34,10 +34,18 @@ mod tests {
     #[test]
     fn accept_requires_ci_lower_bound_not_point_estimate() {
         // 10% median speedup but the CI dips below threshold: rejected.
-        let noisy = RatioCi { median: 1.10, lo: 1.005, hi: 1.21 };
+        let noisy = RatioCi {
+            median: 1.10,
+            lo: 1.005,
+            hi: 1.21,
+        };
         assert_eq!(decide(noisy, 0.02), Verdict::RejectedBench);
         // 4% speedup with a tight CI: accepted.
-        let tight = RatioCi { median: 1.04, lo: 1.025, hi: 1.055 };
+        let tight = RatioCi {
+            median: 1.04,
+            lo: 1.025,
+            hi: 1.055,
+        };
         assert_eq!(decide(tight, 0.02), Verdict::Accepted);
     }
 }