Add matrix regression detection CI workflow

[intech]

Summary

Adds a GitHub Actions workflow that runs the bench-matrix.ts suite on
every PR against main, diffs the results against the latest main
baseline, and posts a sticky comment flagging >5% throughput regressions
and >10% memory regressions. Push-to-main runs refresh the authoritative
baseline artifact. Supporting scripts keep the behaviour reproducible
locally via npm run bench:matrix:ci + npm run bench:matrix:compare.

This is additive — no existing benchmark code is touched beyond
honouring two new env vars (BENCH_MATRIX_TIME, BENCH_MATRIX_WARMUP)
in bench-matrix.ts, which the CI wrapper uses to get tighter RME than
the dev-optimised defaults.

Targets feat/benchmark-matrix (PR #7) so the workflow rides in with
the matrix when that PR lands on main.

What's in the box

• .github/workflows/benchmark.yaml — PR + push + manual triggers,
  Node 22 (matches .nvmrc consumer requirement), 25-minute timeout,
  concurrency group scoped per ref.
• benchmarks/scripts/run-matrix-ci.sh — host profile logging +
  throwaway JIT warmup run + real measurement pass at 3000 ms time /
  1000 ms warmup, extracts the matrix JSON payload from stdout into
  bench-results.json.
• benchmarks/scripts/compare-results.ts — delta computation against
  the baseline, configurable thresholds, emits a sticky-comment-ready
  markdown table. Exits 0 even on regression — the workflow surfaces
  the flag via ::warning:: annotation plus the PR comment so intentional
  throughput trades are not hard-blocked. Tech-lead can promote to
  hard-fail later.
• benchmarks/baselines/README.md — documents the two-tier storage
  decision (Actions artifact bench-baseline-main is source of truth
  with 365-day retention; committed baselines/main.json is the
  zero-network fallback and local-dev quick reference; refreshed by a
  follow-up chore PR after material main-branch moves).
• bench:matrix:ci + bench:matrix:compare npm scripts — same
  pipeline, runnable locally.

Baseline storage decision

Two-tier. Artifacts hold the authoritative baseline because they give
trend history for free and survive repo churn. A committed
baselines/main.json quick-reference de-risks the artifact dependency
and lets developers run the comparison offline. Refresh of the
in-repo file is manual via a chore(benchmarks): refresh main baseline
PR until a follow-up automates it. Rationale in
benchmarks/baselines/README.md.

Test plan

• Workflow YAML parses (python3 -c 'import yaml; yaml.safe_load(open(".github/workflows/benchmark.yaml"))' locally — passes).
• bash -n benchmarks/scripts/run-matrix-ci.sh — passes.
• compare-results.ts smoke test on synthetic baseline + current
  JSON correctly flags a -10% row as REGRESSION, +9.1% as improved,
  and a new-only row as new — verified locally.
• First CI run on this PR produces a bench-results-<n> artifact
  and posts a sticky comment. Since no bench-baseline-main artifact
  exists yet on the fork, the first comment will be informational
  ("No baseline available").
• After this PR rides into main via PR Add benchmark matrix with realistic fixtures #7, the push-to-main run
  uploads the first bench-baseline-main artifact. Subsequent PRs
  get real deltas.

Follow-ups

• Trend dashboard: small JSON-aggregation script that pulls the last
  N bench-baseline-main artifacts and renders a sparkline per fixture
  into the benchmarks README. Blocked on having N>1 baselines.
• Self-hosted single-core runner to cut RME further. GitHub-hosted
  runners give ±2–5% RME on most fixtures; a pinned bare-metal runner
  would bring that to ±0.5% and let us drop the regression threshold
  to 3%.
• Automate the in-repo main.json refresh by having the push-to-main
  job open a PR with the updated file instead of relying on manual
  chore PRs.
• Wire bytesPerOp into bench-matrix.ts (currently only the compare
  script has the plumbing — the fixture runner does not yet emit heap
  delta per op).