Lands the verification surface for the M13 chapter:

tests/test_proxy_jump.rs (new):
- TestServer russh::server fixture that accepts any auth + transparently
  relays direct-tcpip channels to the requested host:port.
- spawn_server() helper binds a loopback port and runs the server in
  a tokio::spawn'd task that owns both the server and the listener.
- two_hop_chain_succeeds: spawns bastion + target, points
  AnvilSession::connect_via_jump_hosts at the chain, asserts success
  (NFR-17 host-key verification path runs at every hop).
- empty_jump_chain_is_rejected: sanity test for the empty-list guard.
- Both tests #[ignore]-gated behind GITWAY_INTEGRATION_TESTS=1 so CI
  doesn't spin up russh::server instances on every run; opt-in via
  `GITWAY_INTEGRATION_TESTS=1 cargo test --test test_proxy_jump
  -- --ignored`.

benches/proxy_chain.rs (new):
- BenchServer mirrors TestServer for use inside the Criterion harness.
- Two Criterion benchmarks: proxy_chain/1_hop_direct_cold and
  proxy_chain/2_hop_via_bastion_cold.
- enforce_nfr16_ratio runs 16 cold-start measurements outside
  Criterion and asserts 2-hop median <= 2 * 1-hop median on
  loopback. NFR-16's 1.5-s/hop budget on a 50-ms RTT link is honest
  only on a real network; the loopback gate enforces the relative
  shape, with real-RTT validation documented as a manual procedure
  in the M13 plan.
- Bench bodies skip when GITWAY_INTEGRATION_TESTS=1 is unset so cargo
  bench doesn't accidentally depend on a running russh::server in CI.

tests/ssh_config_matrix/11_jump_chain.yaml (new):
- Declarative coverage of ProxyJump capture: a chain string survives
  the resolver as raw text for M13.3's parse_jump_chain to consume.

Cargo.toml: registers the new [[bench]] proxy_chain harness.

Tests: 185 lib + 1 matrix + 6 integration + 2 ignored proxy_jump
+ 5 ignored (existing); 0 failures.

Plan: M13.7 of let-us-plan-on-bright-cosmos.md.