Make startup benchmarks lifecycle-safe

[omkhar]

Summary

• move startup benchmark orchestration from shell into the Go citools boundary
• require token-bound teardown, exact session reporting, independent absence verification, bounded output, and bounded lifecycle operations
• preserve raw ordered samples and unrounded stability decisions while labeling results as benchmark-only
• update operator methodology and regression coverage in lockstep

Validation

• live token-owned lifecycle fixture: 8 launches, verified teardown after every launch
• focused Go race tests, vet, Bash syntax, ShellCheck, and quick validation
• three independent peer-review lenses: clean
• exact signed commit PR parity: passed, including live Colima invariants and container smoke

This change does not claim C2 certification; the runner remains explicitly benchmark-only.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ab4cc7083

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".