feat(ci): gate CI on benchmark regression thresholds (#286)

Every test in tests/benchmark/ now asserts its mean run time against a threshold declared next to it, enforced on ubuntu-latest for each supported Python version. Thresholds are in seconds on a nominal machine and are scaled by a per-test measurement of the runner’s speed (a fixed pure-Python reference workload timed immediately before each benchmark), which removes most of the run-to-run variation in GitHub runner hardware. They are calibrated from the normalized means of six CI runs at about 1.5x the average, never below 1.2x the largest value observed.

• tests/benchmark/conftest.py: machine_speed_factor and assert_within_threshold fixtures; the check is enforced only when SPP_BENCHMARK_GATE is set, so a plain local run just reports timings
• ci.yml: the coverage-instrumented test step passes –benchmark-disable; a separate uninstrumented gate step runs on ubuntu-latest with SPP_BENCHMARK_GATE=1, writes the normalized means to the step summary and uploads benchmark.json as an artifact
• Fast bit-reading benchmarks run 1000 pedantic rounds instead of 3; packet-parsing benchmarks let pytest-benchmark calibrate rounds
• codecov.yml ignores tests/benchmark/, which never runs instrumented
• Document the gate and how to recalibrate in developers.md, point the benchmarking page’s regression-guard section at it, add a CHANGELOG entry

Closes #147 Closes #287