perf(planning): restore the integrated benchmark gate

Reduce objective evaluation and calendar allocation work while preserving planner outcomes and deterministic explanations. Restore required benchmark gating and record the unchanged protocol, differential checks, and browser evidence for #78.

docs/gitea-actions.md

@@ -21,11 +21,11 @@ configuration; the Compose files remain manual deployment options.
 | `policy`    | Tests the policy and publisher, then validates the checked-out commit, GitFlow, PR title, commits, and stable release version.                                                                            |
 | `validate`  | Runs lint, formatting, and application/test type checks.                                                                                                                                                  |
 | `test`      | Runs functional coverage with one worker and a 2 GiB Node heap; uploads coverage for seven days even on failure.                                                                                          |
-| `benchmark` | Runs outside coverage with the same worker/heap limits and 300-second protocol timeout. Advisory while #78 is open.                                                                                       |
+| `benchmark` | Required seven-scenario protocol, with one warm-up and two measured repetitions, outside coverage with one worker, a 2 GiB Node heap and the unchanged 300-second timeout. |
 | `build`     | Builds browser/server production bundles and retains `dist` for seven days.                                                                                                                               |
 | `security`  | Runs Semgrep JavaScript/TypeScript SAST and Trivy dependency/secret scans; retains SARIF reports for seven days. Scanner execution must succeed; findings remain reports rather than a new severity gate. |
-| `images`    | Publishes branch/SHA images after required validation, or promotes an existing SHA image for a stable tag. Runs only for pushes and same-repository PRs.                                                  |
-| `required`  | Fails on failed, cancelled, or skipped required validation. Requires image publication when expected; accepts its intentional skip for fork PRs and manual dispatch. Excludes the advisory benchmark.     |
+| `images`    | Publishes branch/SHA images after required validation, including the benchmark, or promotes an existing SHA image for a stable tag. Runs only for pushes and same-repository PRs. |
+| `required`  | Fails on failed, cancelled, or skipped required validation, including the benchmark. Requires image publication when expected; accepts its intentional skip for fork PRs and manual dispatch. |
 
 Push and PR runs are separate so PR title and rebase checks run on the PR event.
 New runs cancel older runs for the same event/ref. Image jobs serialize per