ci(bench): add permissions block, self-referential path filters, drop excess fetch-depth

- Add `permissions: {}` to lock down token scope for the read-only canary
- Add `scripts/update-incremental-report.ts` and
  `tests/benchmarks/regression-guard.test.ts` to path filter so PRs that
  modify the canary machinery itself also trigger the canary
- Remove `fetch-depth: 0` (full history not needed; canary compares against
  committed benchmark data, not git refs)
- Align `node-version: 22` with the integer format used in ci.yml

Author: carlos-alm

.github/workflows/perf-canary.yml

@@ -24,6 +24,10 @@ on:
       - "scripts/incremental-benchmark.ts"
       - "scripts/lib/bench-config.ts"
       - "scripts/lib/fork-engine.ts"
+      - "scripts/update-incremental-report.ts"
+      - "tests/benchmarks/regression-guard.test.ts"
+
+permissions: {}
 
 concurrency:
   group: perf-canary-${{ github.ref }}
@@ -38,12 +42,10 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
 
       - uses: actions/setup-node@v6
         with:
-          node-version: "22"
+          node-version: 22
           cache: "npm"
 
       - name: Setup Rust