Add performance benchmarks and scan hot-path improvements

[bjcorder]

Summary

• Add Criterion benchmarks for parser throughput, representative full-pipeline scans, and analysis-only extraction/linking.
• Add a lightweight CI performance regression guard with a stored baseline and documented update process.
• Reuse Tree-sitter parsers per worker thread, batch parse-phase runtime-budget checks, and use HashSet membership for hot-path dedup before deterministic sorting.

Local benchmark snapshot

• parse_throughput/python: 939.03-953.35 us
• parse_throughput/javascript: 1.2484-1.2726 ms
• parse_throughput/typescript: 748.04-759.40 us
• full_pipeline_scan/realistic_express: 4.2640-4.3583 ms
• full_pipeline_scan/realistic_fastapi: 3.8741-3.9676 ms
• full_pipeline_scan/django: 9.8889-10.089 ms
• analysis_only/extract_and_link: 2.8727-2.9236 ms
• perf guard: 10 ms elapsed vs 5000 ms allowed

Verification

• cargo fmt
• cargo check --workspace --all-targets --locked
• cargo test --workspace --all-targets --locked
• cargo bench -p authmap-cli --bench performance --no-run --locked
• cargo bench -p authmap-cli --bench performance --locked
• bash scripts/perf_guard.sh ci/perf-baseline.env

Closes #116