ci: add criterion benchmark regression gate

[avrabe]

Summary

• Adds .github/workflows/benchmarks.yml — the CI gate for the existing
  criterion verification benchmarks (src/lib/benches/verification_benchmarks.rs),
  which until now had no runner and therefore caught no regressions.
• PR job (bench-sanity): paths-filtered to src/lib/src/**,
  src/lib/benches/**, Cargo.toml, Cargo.lock — runs a fast sanity check
  (cargo bench -p wsc --bench verification_benchmarks -- --sample-size 10 --warm-up-time 1)
  to prove the bench code compiles and executes without a 10+ minute run.
• Nightly job (bench-full): schedule: cron runs the full cargo bench
  and uploads target/criterion/ via actions/upload-artifact@v4.
• Adds a workflow_dispatch: trigger and copies the concurrency: block
  pattern from formal-verification.yml.

Cross-run criterion baseline persistence is intentionally out of scope — it
needs an external artifact store sigil doesn't have; the artifact upload is
sufficient.

Closes #89.

Test plan

• cargo build -p wsc --bench verification_benchmarks compiles cleanly.
• Benchmark harness executes locally — all four criterion groups
  (ed25519_verify, dsse_parse_and_verify, merkle_validation,
  cert_chain_validation) run to Success.
• CI: bench-sanity job runs and passes on this PR.
• CI: nightly bench-full job runs and uploads the criterion-output artifact.

🤖 Generated with Claude Code