CI: auto-refresh benchmarks README table + charts after main merges

[intech]

Summary

Adds .github/workflows/bench-refresh.yaml that runs on every push to main (path-filtered to sources that can affect bench numbers), reruns npm run bench:report -w @bufbuild/protobuf-benchmarks with median-of-5 and CPU 0 pinning, and opens a sticky chore PR on branch chore/bench-refresh when the output differs from what's committed.

Why

benchmarks/README.md has an auto-generated table between <!--BENCHMARK_TABLE_START/END--> markers plus two SVG charts (chart.svg, chart-delta.svg). These are produced by bench:report but nothing refreshed them automatically — the committed numbers drifted as main received encode/decode changes between manual regenerations. #22 just shipped with a README table captured mid-authoring, not post-merge.

Design choices

• Sticky chore PR, not direct push to main. Main is protected; the workflow has contents: write only to push chore/bench-refresh. Refreshes still go through normal review — reviewer sees the delta and decides.
• Self-retrigger guard via path filter. Trigger includes packages/protobuf/**, benchmarks/src/**, benchmarks/scripts/**, benchmarks/proto/**, benchmarks/package.json. The refresh PR only touches benchmarks/README.md + two *.svgs, none of which are in the list, so merging it does not loop.
• Median-of-5 + taskset -c 0. Same noise controls as bench-matrix and run-matrix-ci.sh — BENCH_REPORT_RUNS=5 is already the report.ts default since Drop toBinaryFast from main, archive L1+L2, add upstream baseline #22, workflow pins explicitly as documentation.
• peter-evans/create-pull-request@v7. Standard action for this pattern; force-updates the branch on subsequent main merges instead of stacking duplicate PRs.
• Labels chore + benchmarks — both created on the repo before opening this PR.

Test plan

• Merge this PR.
• Next push to main that touches bench-influencing code should trigger the workflow.
• If the regenerated table/SVGs differ, a PR appears on branch chore/bench-refresh.
• Merging that refresh PR does not retrigger the workflow (path filter excludes README/SVG).
• workflow_dispatch can be used to force-regenerate on demand.