perf: hardware SHA-256, single classification per distinct line, fat LTO

[maxgfr]

Summary

Profiling the 32 MiB capture on 0.5.1 gave: parse 5 ms, view 32 ms, blob 63 ms, artifact 70 ms. Three changes, all output-identical:

• Hardware SHA-256. sha2 only uses ARMv8 / SHA-NI instructions with its asm feature. The 32 MiB digest drops from 55 ms to 10 ms; every capture hashes twice and every read verifies, so this is the largest single cost.
• One classification per distinct line. The compact-v3 pass ran two vocabulary regexes on every line and built a template for every non-diagnostic line. Identical text is now classified once and repetitions copy the result by index. The template builder scans bytes and only decodes non-ASCII characters; a unit test proves it equal to the previous character-by-character version on Unicode whitespace, control bytes, digit and hex runs. Line texts are hashed with foldhash instead of SipHash.
• Release profile. Fat LTO, one codegen unit, abort on panic: a third smaller binary and a few percent per call.

Also: bench/publish.py measures one binary and publishes the only figures the repository keeps (bench/results/content.json, bench/results/performance.json, and the README speed table between its markers, stamped with the version measured). Older figures are deleted rather than archived. The dated competitor inspection in docs/comparison.md is removed with them.

Measurements (macOS arm64, cold cache, 30 repetitions, outputs byte-identical on every case)

Case	0.5.1	This branch
Compress a 32 MiB stream	177 ms	62 ms
Compress a 3 MB log	27 ms	15 ms
Compress a 12,000-row JSONL table	29 ms	20 ms
Paged recovery from a stored original	11 ms	7 ms
Compress a 136 KB log	5 ms	5 ms
Small output (process startup)	3.6 ms	3.6 ms

Byte equality was also checked on a 19-input differential corpus (ANSI colours, carriage-return progress, vertical tab and form feed, no-break and ideographic spaces, hex identifiers, stack frames, JSON, JSONL, malformed lines).

Considered and not taken

• mimalloc: 13% on the allocation-heavy aggregate query, neutral elsewhere; not worth a second C dependency.
• sonic-rs / simd-json for the artifact: artifact identities are the SHA-256 of the exact serde_json serialization, so a different serializer would have to be byte-identical; not attempted.
• Skipping the artifact copy of the input would change the recovery contract; not attempted.

Verification

cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test (new template equivalence test), cargo run -- bench, scripts/check_skill.py, bench unit tests (17), npm test (10/10 with dependencies installed), scripts/check_readme.py, scripts/check_adapters.py, bench/publish.py end to end.