bench: GitHub Actions CI — trust-layer checks, no-net gates, runner calibration

Closes the CI-reachable slice of the Phase 1 infra gaps:
- trust-layer job: cargo test + clippy -D warnings + fmt
- target-gates-no-net: fetches pinned targets (new targets/fetch.sh),
  regenerates + verifies corpora, runs 'just gates tokei'
  mechanically, and executes the bench workload inside a
  --network=none container (SPEC 3.1/10 no-net requirement)
- runner-calibration (informational): A/A + injection harness measures
  the shared runner's noise floor per run, evidence uploaded as an
  artifact — environments are judged empirically, not assumed
- perf-probe (informational): reports which perf event sources work

docs/infra.md maps each remaining hardware requirement (pinned cores,
governor/SMT control, separate-uid trust layer) to the bench-metal
self-hosted runner setup a human can complete in ~15 min.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/diff-test/src/orchestrate.rs

@@ -43,7 +43,10 @@ pub fn run_core_gates(
             GateOutcome::Passed
         } else {
             GateOutcome::Failed {
-                detail: String::from_utf8_lossy(&t.stderr).chars().take(2000).collect(),
+                detail: String::from_utf8_lossy(&t.stderr)
+                    .chars()
+                    .take(2000)
+                    .collect(),
             }
         },
     ));
@@ -57,7 +60,10 @@ pub fn run_core_gates(
             GateOutcome::Passed
         } else {
             GateOutcome::Failed {
-                detail: format!("exit={:?} expected={expected} actual={actual}", g.status.code()),
+                detail: format!(
+                    "exit={:?} expected={expected} actual={actual}",
+                    g.status.code()
+                ),
             }
         },
     ));