Honor benchmark suite defaults

Pass suite-level load and duration defaults into the unsafe public
inbox destination check.  Public inbox runs allowed with
--allow-unsafe-target now follow the same documented explicit-default
contract as the top-level target gate.

#744
#784

Assisted-by: Codex:gpt-5.5

Author: dahlia

packages/cli/src/bench/action.test.ts

@@ -390,6 +390,52 @@ scenarios:
   }
 });
 
+test("runBench - unsafe public inbox destination honors suite defaults", async () => {
+  const target = await spawnBenchmarkTarget();
+  try {
+    const file = await writeSuite(`version: 1
+target: ${target.url.href}
+defaults:
+  duration: 1ms
+  load: { rate: 1/s }
+scenarios:
+  - name: inbox-shared
+    type: inbox
+    recipient: "${new URL("/users/alice", target.url).href}"
+    inbox: "https://prod.example/inbox"
+`);
+    let code = -1;
+    let message = "";
+    await runBench(
+      command({
+        scenario: file,
+        target: target.url.href,
+        allowUnsafeTarget: true,
+        advertiseHost: "127.0.0.1",
+      }),
+      {
+        exit: (c) => {
+          code = c;
+        },
+        writeOutput: () => Promise.resolve(),
+        log: (m) => {
+          message = m;
+        },
+        fetch: (input) => {
+          const url = new URL(input instanceof Request ? input.url : input);
+          if (url.hostname === "prod.example") {
+            return Promise.resolve(new Response("accepted", { status: 202 }));
+          }
+          return fetch(input);
+        },
+      },
+    );
+    assert.strictEqual(code, 0, message);
+  } finally {
+    await target.close();
+  }
+});
+
 test("runBench - malformed expect assertion exits 2 before any load", async () => {
   // The expect typo must be caught in preflight, so the run exits 2 (a config
   // error) without ever probing the target or sending load.

packages/cli/src/bench/action.ts

@@ -181,6 +181,7 @@ export default async function runBench(
       targetBenchmarkMode: probe.benchmarkMode,
       allowUnsafe: command.allowUnsafeTarget,
       explicitCliTarget: command.target != null,
+      suite: validated,
     });
   };
 
@@ -447,6 +448,7 @@ interface PublicDestinationOverrideContext {
   readonly targetBenchmarkMode: boolean;
   readonly allowUnsafe: boolean;
   readonly explicitCliTarget: boolean;
+  readonly suite: Suite;
 }
 
 function assertPublicDestinationOverrideAllowed(
@@ -467,7 +469,7 @@ function assertPublicDestinationOverrideAllowed(
     benchmarkMode: false,
     allowUnsafe: true,
     explicitCliTarget: context.explicitCliTarget,
-    scenarios: [unsafeOverrideScenario(scenario)],
+    scenarios: [unsafeOverrideScenario(scenario, context.suite)],
   });
 }