ci: run complex-query cold-traffic benchmarks in the benchmark job

The prod-gating measurement (complex-query-bench: tuple-to-userset,
chains, defeasible, comparators, OWA, nested fusion, mixed unions over
cold traffic with binary parity) was committed but never ran in CI. The
benchmark job now runs it alongside the possibilistic baseline compare,
uploads the results artifact, and surfaces both in the run summary.

Also: refreshed the committed .rigor-baseline.json (engine unchanged
since the tag; the runner's canonical baseline lives in its artifact
store), and added npm run benchmark:complex-query for local runs.

.gitea/workflows/ci.yaml

@@ -70,6 +70,10 @@ jobs:
         run: node --expose-gc scripts/benchmark.js --json > bench-results.json
         continue-on-error: true
 
+      - name: Run complex-query benchmarks (cold traffic, normal vs binary)
+        run: node --expose-gc benchmarks/complex-query-bench.js --size=25000 --samples=10000 > complex-query-results.json
+        continue-on-error: true
+
       - name: Save baseline (on tag)
         if: startsWith(github.ref, 'refs/tags/v')
         run: node --expose-gc scripts/benchmark.js --save
@@ -87,7 +91,9 @@ jobs:
         uses: actions/upload-artifact@v3
         with:
           name: bench-results
-          path: bench-results.json
+          path: |
+            bench-results.json
+            complex-query-results.json
           retention-days: 30
 
       - name: Benchmark summary
@@ -99,6 +105,12 @@ jobs:
             cat bench-results.json >> $GITHUB_STEP_SUMMARY
             echo '```' >> $GITHUB_STEP_SUMMARY
           fi
+          if [ -f complex-query-results.json ]; then
+            echo '### Complex-Query Results (cold traffic, normal vs binary)' >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            cat complex-query-results.json >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
 
   publish:
     runs-on: ubuntu-latest