bench: wasm-opt benchmark harness — Hetzner config sweeps + local QEMU VM

Tooling that produced the perf findings (committed for rerunnability):
- scripts/bench/wasm-opt-bench.sh + o2-config-sweep.sh + sweep.conf:
  replay asyncify/-O2 over a cached fixture under allocator/THP/core
  matrices on the Hetzner runner.
- scripts/bench/setup-vm.sh + cloud-init/ + vm-build.sh: local QEMU
  (HVF) Ubuntu guest with Docker CE to verify Linux builds without
  burning paid runners.
- .gitignore: bench fixtures/results and the VM image stay local.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/bench/cloud-init/user-data

@@ -0,0 +1,40 @@
+#cloud-config
+# NoCloud seed for the wasm-opt benchmark VM. setup-vm.sh substitutes
+# __SSH_PUBKEY__ with your ~/.ssh/id_ed25519.pub before building the seed ISO.
+hostname: kicad-bench
+users:
+  - name: bench
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+    shell: /bin/bash
+    lock_passwd: false
+    # Fallback console/SSH password (key auth is preferred). Change if you care.
+    plain_text_passwd: bench
+    ssh_authorized_keys:
+      - __SSH_PUBKEY__
+ssh_pwauth: true
+package_update: true
+# Docker CE from the official repo (mirrors the CI workflow's install step) so
+# scripts/bench/vm-build.sh can run the full docker/build.sh pipeline in-guest.
+apt:
+  sources:
+    docker.list:
+      source: "deb [signed-by=$KEY_FILE] https://download.docker.com/linux/ubuntu noble stable"
+      keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
+packages:
+  - git
+  - curl
+  - ca-certificates
+  - time
+  - libjemalloc2
+  - strace
+  - rsync
+  - docker-ce
+  - docker-ce-cli
+  - containerd.io
+  - docker-buildx-plugin
+  - docker-compose-plugin
+runcmd:
+  # The docker group only exists after the package installs, so the user's
+  # `groups:` stanza can't grant it — add membership here (applies to new
+  # ssh sessions, which is all vm-build.sh uses).
+  - usermod -aG docker bench