feat(workflows): add artifact size budgets

[szmyty]

Outcome

Adds a reusable, warning-aware artifact budget contract for JavaScript/web and non-JavaScript outputs without taking ownership of consumer builds.

• adds egohygiene.relay.artifact-budget-report/v1;
• adds a composite action with filesystem and size-limit-json adapters;
• adds a read-only reusable workflow that consumes caller-produced Actions artifacts;
• reports absolute bytes, baseline byte/percentage deltas, repository-configured budgets, and pass / warn / fail / missing-baseline / unsupported states;
• supports advisory and blocking enforcement while retaining deterministic JSON evidence;
• proves web Size Limit and native/archive adoption patterns;
• dogfoods the reusable handoff in Relay validation.

Authority and safety

• no consumer repository checkout or consumer code execution;
• no package installation inside Relay;
• contents: read only and no repository/provider mutation;
• immutable current/baseline revision binding;
• traversal, symlink, special-file, duplicate, malformed, oversized, and incomplete evidence rejection;
• bounded filesystem-entry, byte, JSON, and Size Limit item scans;
• blocking failures upload the completed report before the job fails;
• no runtime-performance claim is inferred from artifact bytes.

The consumer owns builds, Size Limit/plugins/lockfile, artifact production, threshold profile, and the advisory/blocking choice.

Tool research

The official Size Limit repository was live and not archived on 2026-09-17. Relay normalized the documented --json boundary at source revision b1d4c43c6a92ea8b610898d342c9086c66d43ac3 instead of adopting a wrapper action. Size Limit remains JavaScript-specific; native binaries, static sites, archives, and exported container-image archives use raw filesystem measurement.

Validation

• 356 repository tests passed
• 38 focused artifact-budget/catalog tests passed
• action and workflow catalog validation passed
• continuity-contract validation passed
• Python compilation passed
• 47 JSON documents parsed
• 29 YAML documents parsed with PyYAML
• 72 inline Bash blocks and repository shell files passed bash -n
• git diff --check passed
• implementation tree: 79cb82264dbe8be5832025e52e72e2463260615d
• exact continuity-only final head: 359dd7792234ef0728d18c3c18d2d0eb088248e2

Ruby/Psych is unavailable locally; the repository's exact CI parser remains the final YAML validation gate.

Governance

Roadmap disposition: evidence-reconciled-no-state-transition.

No new ADR is required. This operationalizes the existing externalized-package, least-privilege, immutable-reference, repository-release-unit, and workflow-catalog decisions.

This PR intentionally does not publish v1.6.0 or move v1. Issue #17 should remain open for that later batched release gate.

Advances #17