bench: GitHub Actions CI — trust-layer checks, no-net gates, runner calibration

Closes the CI-reachable slice of the Phase 1 infra gaps:
- trust-layer job: cargo test + clippy -D warnings + fmt
- target-gates-no-net: fetches pinned targets (new targets/fetch.sh),
  regenerates + verifies corpora, runs 'just gates tokei'
  mechanically, and executes the bench workload inside a
  --network=none container (SPEC 3.1/10 no-net requirement)
- runner-calibration (informational): A/A + injection harness measures
  the shared runner's noise floor per run, evidence uploaded as an
  artifact — environments are judged empirically, not assumed
- perf-probe (informational): reports which perf event sources work

docs/infra.md maps each remaining hardware requirement (pinned cores,
governor/SMT control, separate-uid trust layer) to the bench-metal
self-hosted runner setup a human can complete in ~15 min.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/diff-test/src/lib.rs

@@ -9,8 +9,8 @@
 
 pub mod orchestrate;
 pub mod pin;
-pub mod target;
 pub mod policy;
+pub mod target;
 
 use serde::{Deserialize, Serialize};
 
@@ -35,11 +35,12 @@ pub enum GateLayer {
 
 /// All layers must pass; any failure is an auto-reject (SPEC §8).
 pub fn all_passed(results: &[(GateLayer, GateOutcome)]) -> bool {
-    results.iter().all(|(_, o)| {
-        matches!(o, GateOutcome::Passed | GateOutcome::Skipped { .. })
-    }) && results
+    results
         .iter()
-        .any(|(_, o)| matches!(o, GateOutcome::Passed))
+        .all(|(_, o)| matches!(o, GateOutcome::Passed | GateOutcome::Skipped { .. }))
+        && results
+            .iter()
+            .any(|(_, o)| matches!(o, GateOutcome::Passed))
 }
 
 #[cfg(test)]
@@ -52,7 +53,9 @@ mod tests {
             (GateLayer::UpstreamTests, GateOutcome::Passed),
             (
                 GateLayer::GoldenReplay,
-                GateOutcome::Failed { detail: "stdout diverged".into() },
+                GateOutcome::Failed {
+                    detail: "stdout diverged".into(),
+                },
             ),
         ];
         assert!(!all_passed(&results));
@@ -62,7 +65,9 @@ mod tests {
     fn all_skipped_is_not_a_pass() {
         let results = vec![(
             GateLayer::Sanitizers,
-            GateOutcome::Skipped { reason: "n/a".into() },
+            GateOutcome::Skipped {
+                reason: "n/a".into(),
+            },
         )];
         assert!(!all_passed(&results));
     }