bench: secs_bench harness + BENCHMARKS.md baseline

Customer SREs and capacity planners had nothing to point at.
INTEGRATION.md asked the right questions ("how many tx/sec?"
"how much memory per active CJ?") but had no numbers.

secs_bench spins up an in-process passive equipment + active host
on an OS-allocated port, runs three canned workloads, and emits a
markdown table customers can capture and diff across commits:

- S1F1/F2 header-only round-trip   — dispatch + framing baseline
- S1F3/F4 with N SVIDs             — encode + decode throughput
- S6F11 push (W=0)                  — one-way emission ceiling
- PJ + CJ pair memory footprint    — bytes per active job

Latency reports p50/p95/p99/max via std::nth_element over the
sample vector.  RSS is read from /proc/self/statm on Linux,
mach_task_basic_info on macOS.

CLI: --requests / --concurrency / --svid-count / --store-pairs.
Default 20k req @ 16 concurrent.

BENCHMARKS.md checks in a reference run (Docker on M-series
macOS): ~140k req/s S1F1, ~79k req/s S1F3 with 32-SVID list,
~572k S6F11/s push, ~450 bytes per PJ+CJ pair.  Three orders of
magnitude headroom over typical fab tool load.

The doc is explicit about what the bench does NOT measure (real
network, persistence I/O, TLS tunnel overhead, multi-session GS
dispatch) — customers should re-run on their target hardware.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README.md

@@ -9,8 +9,9 @@ Implements **all of E5, E30, E37 (SS + GS), E4 SECS-I, E40, E42, E84, E87,
 E90, E94, E116, E120, E148, E157, E39**.  Per-store persistence on every
 mutable in-memory entity (spool, carriers, load-ports, substrates,
 process-jobs, control-jobs, exceptions).  See **[COMPLIANCE.md](COMPLIANCE.md)**
-for the per-capability audit and **[INTEGRATION.md](INTEGRATION.md)** for
-the vendor-side tutorial.
+for the per-capability audit, **[INTEGRATION.md](INTEGRATION.md)** for
+the vendor-side tutorial, and **[BENCHMARKS.md](BENCHMARKS.md)** for the
+performance envelope.
 
 > **License: proprietary — see [LICENSE](LICENSE).**  No use, copy,
 > compile, evaluate, benchmark, or deploy without a written license