packaging: README (NASA style) + possibilistic perf baseline + CI benchmark job

README: purpose-first (possibility not boolean, caller owns evidence/time),
install, verified quick start, concepts (result shape, overlays, temporal
context), API table, development commands, design notes.

benchmark: scripts/benchmark.js on @tenere/benchmark-lib — eight contours
(direct/union/denied/meta/overlay/binary checks, snapshot build/restore),
committed .rigor-baseline.json, exit 1 on high-severity regressions.

CI: benchmark job compares on push (continue-on-error), re-saves baseline
and uploads it as an artifact on tags; publish now depends on benchmark
passing as well as test.

.gitea/workflows/ci.yaml

@@ -35,10 +35,75 @@ jobs:
       - name: Rigor campaigns
         run: npm run test:rigor
 
+  benchmark:
+    runs-on: ubuntu-latest
+    needs: test
+    if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/master'
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Auth for Gitea npm registry
+        run: |
+          echo "@rigor:registry=https://hub.kl1.tenere.ai/api/packages/Rigor/npm/" > .npmrc
+          echo "//hub.kl1.tenere.ai/api/packages/Rigor/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
+          echo "@tenere:registry=https://hub.kl1.tenere.ai/api/packages/Tenere/npm/" >> .npmrc
+          echo "//hub.kl1.tenere.ai/api/packages/Tenere/npm/:_authToken=${{ secrets.PACKAGE_TOKEN }}" >> .npmrc
+
+      - run: npm ci
+
+      - name: Download previous baseline
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          name: baseline
+          path: .
+        continue-on-error: true
+
+      - name: Run benchmarks (compare against baseline)
+        run: node --expose-gc scripts/benchmark.js --json > bench-results.json
+        continue-on-error: true
+
+      - name: Save baseline (on tag)
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: node --expose-gc scripts/benchmark.js --save
+
+      - name: Upload baseline artifact
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: actions/upload-artifact@v3
+        with:
+          name: baseline
+          path: .rigor-baseline.json
+          retention-days: 90
+
+      - name: Upload benchmark results
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: bench-results
+          path: bench-results.json
+          retention-days: 30
+
+      - name: Benchmark summary
+        if: always()
+        run: |
+          echo '### Benchmark Results' >> $GITHUB_STEP_SUMMARY
+          if [ -f bench-results.json ]; then
+            echo '```json' >> $GITHUB_STEP_SUMMARY
+            cat bench-results.json >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
   publish:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: test
+    needs: [test, benchmark]
 
     steps:
       - uses: actions/checkout@v4