bench: GitHub Actions CI — trust-layer checks, no-net gates, runner calibration

Closes the CI-reachable slice of the Phase 1 infra gaps:
- trust-layer job: cargo test + clippy -D warnings + fmt
- target-gates-no-net: fetches pinned targets (new targets/fetch.sh),
  regenerates + verifies corpora, runs 'just gates tokei'
  mechanically, and executes the bench workload inside a
  --network=none container (SPEC 3.1/10 no-net requirement)
- runner-calibration (informational): A/A + injection harness measures
  the shared runner's noise floor per run, evidence uploaded as an
  artifact — environments are judged empirically, not assumed
- perf-probe (informational): reports which perf event sources work

docs/infra.md maps each remaining hardware requirement (pinned cores,
governor/SMT control, separate-uid trust layer) to the bench-metal
self-hosted runner setup a human can complete in ~15 min.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/diff-test/src/lib.rs

@@ -9,8 +9,8 @@
 
 pub mod orchestrate;
 pub mod pin;
-pub mod target;
 pub mod policy;
+pub mod target;
 
 use serde::{Deserialize, Serialize};
 
@@ -35,11 +35,12 @@ pub enum GateLayer {
 
 /// All layers must pass; any failure is an auto-reject (SPEC §8).
 pub fn all_passed(results: &[(GateLayer, GateOutcome)]) -> bool {
-    results.iter().all(|(_, o)| {
-        matches!(o, GateOutcome::Passed | GateOutcome::Skipped { .. })
-    }) && results
+    results
         .iter()
-        .any(|(_, o)| matches!(o, GateOutcome::Passed))
+        .all(|(_, o)| matches!(o, GateOutcome::Passed | GateOutcome::Skipped { .. }))
+        && results
+            .iter()
+            .any(|(_, o)| matches!(o, GateOutcome::Passed))
 }
 
 #[cfg(test)]
@@ -52,7 +53,9 @@ mod tests {
             (GateLayer::UpstreamTests, GateOutcome::Passed),
             (
                 GateLayer::GoldenReplay,
-                GateOutcome::Failed { detail: "stdout diverged".into() },
+                GateOutcome::Failed {
+                    detail: "stdout diverged".into(),
+                },
             ),
         ];
         assert!(!all_passed(&results));
@@ -62,7 +65,9 @@ mod tests {
     fn all_skipped_is_not_a_pass() {
         let results = vec![(
             GateLayer::Sanitizers,
-            GateOutcome::Skipped { reason: "n/a".into() },
+            GateOutcome::Skipped {
+                reason: "n/a".into(),
+            },
         )];
         assert!(!all_passed(&results));
     }

crates/diff-test/src/orchestrate.rs

@@ -43,7 +43,10 @@ pub fn run_core_gates(
             GateOutcome::Passed
         } else {
             GateOutcome::Failed {
-                detail: String::from_utf8_lossy(&t.stderr).chars().take(2000).collect(),
+                detail: String::from_utf8_lossy(&t.stderr)
+                    .chars()
+                    .take(2000)
+                    .collect(),
             }
         },
     ));
@@ -57,7 +60,10 @@ pub fn run_core_gates(
             GateOutcome::Passed
         } else {
             GateOutcome::Failed {
-                detail: format!("exit={:?} expected={expected} actual={actual}", g.status.code()),
+                detail: format!(
+                    "exit={:?} expected={expected} actual={actual}",
+                    g.status.code()
+                ),
             }
         },
     ));

crates/diff-test/src/policy.rs

@@ -67,7 +67,10 @@ mod tests {
         .unwrap();
         assert_eq!(
             EquivalencePolicy::load(&dir).unwrap(),
-            EquivalencePolicy::FpTolerance { abs: 1e-9, rel: 1e-6 }
+            EquivalencePolicy::FpTolerance {
+                abs: 1e-9,
+                rel: 1e-6
+            }
         );
     }
 }