M12.9: NFR-15 latency bench + matrix completion

[UnbreakableMJ]

Summary

Adds the NFR-15 enforcement gate and rounds out the acceptance matrix for M12.9.

NFR-15 latency bench

benches/ssh_config_latency.rs is a Criterion harness with two scenarios:

• resolve_typical_user_config — a representative ~30-line user config exercising every directive Anvil currently honors (HostName, User, Port, multi-IdentityFile, IdentitiesOnly, StrictHostKeyChecking, UserKnownHostsFile, the four algorithm directives, ConnectTimeout, ConnectionAttempts, ProxyJump, ProxyCommand, plus a multi-pattern Host with negation).
• resolve_no_match — worst single-file walk: every Host block inspected, no match found, only Global directives returned.

After the Criterion measurement, an enforce_budget() step runs 32 cold resolves outside the statistical pipeline and asserts the median is ≤ 5 ms per PRD NFR-15. Hard-fails with an actionable message if exceeded — surfaces regressions as a CI failure rather than a Criterion warning.

Local result on a Windows host (cold): median 283 µs for resolve_typical_user_config, 226 µs for resolve_no_match. 17× under the budget.

Matrix completion

Six new YAML fixtures under tests/ssh_config_matrix/ cover the directives PRD §5.8.1 calls out by name:

• 04_proxy_jump.yaml — ProxyJump captured raw.
• 05_proxy_command.yaml — ProxyCommand re-joined with single spaces.
• 06_connect_timeout.yaml — ConnectTimeout (seconds → Duration) + ConnectionAttempts.
• 07_multi_identity.yaml — multiple IdentityFile lines accumulate in source order.
• 08_global_then_specific.yaml — global User wins via first-occurrence-rule against a later per-host override.
• 09_specific_then_global.yaml — canonical layout: per-host overrides at the top, Host * defaults at the bottom; per-host wins.

The existing matrix_walks_pass harness picks them up automatically.

Versioning

No version bump: benches and matrix YAMLs are dev-only — never shipped in the published crate's runtime tree. The published surface of anvil-ssh is unchanged.

Test plan

• CI passes (Linux/macOS/Windows + MSRV 1.88).
• cargo fmt --all -- --check clean.
• cargo clippy --all-targets --all-features -- -D warnings clean.
• cargo test --lib --tests --locked green: 153 lib + 1 matrix harness + 6 integration, 0 failures.
• cargo bench --bench ssh_config_latency completes; the embedded enforce_budget() step does not panic.

🤖 Generated with Claude Code