ci(bench): add weekly-cron + manual-dispatch criterion workflow

WHY: slice 4 of T1 test-architecture decomposition. Runs
`cargo bench -p perima-hash -p perima-db` on Mondays 07:00 UTC
(1h after slice 3 cargo-fuzz to avoid runner-pool contention)
+ on-demand via workflow_dispatch (with optional sample_size input).

Linux-only (perf is OS-variant; cross-OS comparison would mislead).
Single job (no matrix — both benches share a compile cache).
Bench step is `continue-on-error: true` (observability-only) — any
non-zero exit doesn't block the workflow; results are tee'd to
\$GITHUB_STEP_SUMMARY so the workflow run page shows the latest
numbers.

target/criterion/ HTML reports upload as `criterion-reports` artifact
for deep-dive analysis. NO threshold gate, NO PR-blocking, NO
baseline-comparison infrastructure (per spec D-4 + Batch J GH #135
flake-risk precedent).

Author: utof

.github/workflows/bench.yml

@@ -0,0 +1,80 @@
+# criterion benchmarks weekly cron + manual workflow_dispatch.
+# Slice 4 of T1 test-architecture decomposition.
+# See spec: docs/superpowers/specs/2026-04-25-criterion-benches-design.md
+#
+# WHY a separate workflow (not added to ci.yml): criterion runs are
+# bounded MINUTES, not seconds; per-PR queue cost is disproportionate.
+# Decoupling lets bench fail-or-skip independently of the main matrix.
+
+name: bench
+
+on:
+  schedule:
+    - cron: '0 7 * * 1'  # Mondays 07:00 UTC (1h after slice 3 cargo-fuzz)
+  workflow_dispatch:
+    inputs:
+      sample_size:
+        description: 'criterion sample size per benchmark'
+        type: string
+        default: '30'
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  bench:
+    name: cargo bench
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+
+      # WHY GTK deps even though no benched crate uses them: matches
+      # slice 1/3 workflow-scaffolding pattern. perima-hash + perima-db
+      # don't transitively need GTK; the install is defensive.
+      - name: Install image/system deps
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq \
+            libgtk-3-dev \
+            libwebkit2gtk-4.1-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      # WHY continue-on-error: per spec D-4, observability-only mode.
+      # Bench step might fail on transient runner issues; swallowing
+      # the exit lets artifact upload still run. Consistent posture
+      # with slice 1/3 workflows.
+      #
+      # WHY scoped to `-p perima-hash -p perima-db` (NOT --workspace):
+      # this slice pins exactly 2 benched crates. `cargo bench --workspace`
+      # would compile + invoke benches in any future workspace crate that
+      # gets a [[bench]] entry, scope-creeping the slice's contract.
+      - name: Run cargo bench (perima-hash + perima-db)
+        continue-on-error: true
+        env:
+          SAMPLE_SIZE: ${{ github.event.inputs.sample_size || '30' }}
+        run: |
+          # Tee bench output to GITHUB_STEP_SUMMARY so the run page shows
+          # the latest numbers without artifact download.
+          {
+            echo "## criterion benchmark results"
+            echo ""
+            echo '```'
+            cargo bench -p perima-hash -p perima-db -- --sample-size "$SAMPLE_SIZE" 2>&1
+            echo '```'
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload criterion target dir (raw HTML reports)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: criterion-reports
+          path: target/criterion/
+          if-no-files-found: ignore