feat: enforce issue 11 performance and lifecycle gates

[douglasjarquin]

Summary

• Add payload-free production performance instrumentation for shortcut, persistence, capture, transcription, cleanup, insertion, and resource release boundaries.
• Encode issue [10/13 · Performance] Enforce resource budgets and lifecycle release gates #11 hard budgets and fail-closed release evaluation, including duplicate, malformed, and wrong-duration evidence rejection.
• Document a reproducible Xcode/Instruments benchmark and release-check procedure with a machine-checked 60-second raw-final scenario and a separate five-minute long-form scenario.
• Extend deterministic lifecycle coverage and CI regression through issue [09/13 · Reliability] Harden device changes, interruptions, cancellation, and failure paths #10.

Closes #11

Verification

• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift build passed.
• Spike contracts and issue [02/13 · MVP] Build the native menu-bar shell and dictation state machine #3 through issue [10/13 · Performance] Enforce resource budgets and lifecycle release gates #11 contract suites passed.
• Issue [10/13 · Performance] Enforce resource budgets and lifecycle release gates #11 event, budget, lifecycle, transcription-release, filter, duplicate, malformed-value, and duration checks passed.
• SourceKit diagnostics returned no diagnostics on changed Swift files.
• Exact-head Release xcodebuild passed with Xcode 26.6.
• The real Release Oigo.app showed its status item and Welcome to Oigo onboarding surface after an explicit readiness wait, then quit cleanly with no Oigo process remaining.
• No microphone, audio, or transcript action was invoked during manual QA.

Evidence and limitations

• OSLog events are payload-free and generated evidence stays outside the delivery commit.
• Native CPU, footprint, latency, microphone, Speech/Foundation Models, Apple-managed model-service, whole-system pressure, long-form, device, sleep/wake, lock/unlock, low-memory, force-quit, and network-disabled measurements are explicitly INCONCLUSIVE on this host.
• The performance matrix records the exact missing host boundaries and links future hard-limit exceptions to issue [Roadmap] Oigo v1 — native, durable, on-device dictation #1.
• The five exact-SHA review lanes returned INCONCLUSIVE, not approval, because of host-unavailable measurements; no lane reported a new code defect.