[perf] Benchmark suite for clock computation and subject lookup

[KayleeWilliams]

Why

"We tracked your deadline correctly" is not credible without latency bounds, and benchmarks are the only way to catch quadratic-complexity regressions before customers do. Zero benchmarks exist today.

Scope

• Script: create 10k requests, generate timelines with up to 1k events each
• Assert clock recompute < 50ms at p95
• Assert subject lookup < 100ms at p95 (after subject-index issue lands)
• Assert policy diff / upgrade stays sub-second at 100 packs
• Runs in CI on a perf label (not every PR, but on main and release branches)
• Report regressions against previous baseline

Priority: P1 - beta blocker