chore(changeset): perf-timing per-request gating (#2408)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011upHdyr5AnNc6dWAu63qxD

Author: claude

.changeset/perf-timing-per-request-gating.md

@@ -0,0 +1,29 @@
+---
+"@objectstack/observability": minor
+"@objectstack/plugin-hono-server": minor
+"@objectstack/runtime": minor
+---
+
+feat(observability): admin-gated per-request `Server-Timing` via `X-OS-Debug-Timing` (#2408)
+
+Perf-tuning mode was previously global-only (`serverTiming` option /
+`OS_SERVER_TIMING`), which discloses internal phase durations — a mild
+backend-fingerprinting surface — to every caller. This adds the per-request
+gating path from the design so an operator can pull a single request's
+`Server-Timing` breakdown on a live environment without turning the header on
+for everyone.
+
+- **observability**: a request-scoped disclosure gate (`runWithPerfDisclosure`,
+  `allowPerfDisclosure`, `isPerfDisclosureAllowed`, `PerfDisclosureGate`) kept
+  separate from the pure `PerfTiming` collector and pinned to its own
+  `Symbol.for` store so the middleware and dispatcher share it across module
+  copies.
+- **plugin-hono-server**: the Server-Timing middleware is registered by default
+  (unless `serverTiming: false`). It runs the collector when timing is global
+  **or** the request sends `X-OS-Debug-Timing: 1`, and emits the header only
+  when the gate is open. `OS_PERF_TIMING=1` now also enables global mode.
+- **runtime**: after resolving the execution context, the dispatcher opens the
+  gate for admin/service/system principals, so ordinary callers never receive
+  the header even if they send the debug header.
+
+Existing global-mode behavior is unchanged.