bench: complex-query cold-traffic benchmark (normal vs binary)

Prod gating is dominated by rule-based queries, not direct relations.
complex-query-bench.js measures cold-traffic latency (distinct
subject/object per sample, no cache reuse) across seven complex policy
shapes — tuple-to-userset, 2-hop chain, defeasible exclusion, ABAC
relational comparator, OWA union, nested comparator + OWA fusion, and a
mixed 10-rule union — for both evaluation paths, and enforces binary/
normal decision parity on every query.

At 25k and 100k nodes: binary wins every scenario (1.15x-2.0x median
speedup), p99 stays sub-0.05ms, and parity mismatches are zero across
all scenarios. Binary's early exit wins where a strong rule exists; the
earlier direct-relation 'binary slower' observation was a cache-hit
artifact (normal serves repeat queries from the rule result cache,
binary correctly does not, since thresholds are per-call options).

Note: report median, not avg — GC outliers inflate the mean (avg > p95
observed on two rows).

package.json

@@ -48,7 +48,8 @@
     "benchmark:sharded": "node benchmarks/sharded-snapshot-build.js",
     "benchmark:memory": "node benchmarks/memory-breakdown.js",
     "benchmark:multi-hop": "node benchmarks/multi-hop-rule-bench.js",
-    "benchmark:save": "node --expose-gc scripts/benchmark.js --save"
+    "benchmark:save": "node --expose-gc scripts/benchmark.js --save",
+    "benchmark:complex": "node --expose-gc benchmarks/complex-query-bench.js"
   },
   "keywords": [
     "zanzibar",