perf(capture): reject bounded writes before loading embeddings - #492

main itself no longer clears the published FLOOR_* thresholds in
reproduce.sh (LongMemEval MRR 0.904988 < 0.914, LoCoMo MRR 3-run mean
0.779868 < 0.805, LoCoMo Recall@10 0.889506 < 0.915 — all measured via
this same script, cdeust/Cortex PR cdeust#492), so every PR built on main
inherited an already-failing gate it did not cause and could not pass.

check_floors now rounds `got` to the same 4-decimal precision it prints
before computing delta/status (comparing at a hidden precision beyond
what's displayed was the source of borderline-case confusion), and no
longer exits 1 — same disposition as the pyright ratchet in issue cdeust#188
("raising the floor would just hide the debt").

Add benchmarks/lib/bench_regression.sh + reproduce.sh --no-regression:
runs the same suite against --baseline-ref (default origin/main) in an
isolated git worktree, in the same container, then fails only if HEAD
is worse than its own baseline by more than the tolerance. This is the
blocking gate a PR should use instead of lowering FLOOR_*.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01StMBvNd7eVJGtpnC2zNsx1

The Docker Smoke job wrote its buildx layer cache with
`cache-to: type=gha,mode=max` on every event. On run 34225008423
(PR cdeust#492) the image build finished at 70.8s and the job was still in
`exporting to GitHub Actions Cache` when the 13-minute bound fired at
827s. The smoke-test body never ran, so the PR went red on a step that
asserts nothing about the code under review.

GitHub Actions scopes a cache entry to the ref that created it: the
default branch's entries are readable from every branch, but an entry a
PR run writes is readable only by that same PR's later runs. This job
runs once per head commit, so a PR-written entry is exported and then
never read — pure cost on the critical path.

Skip the export on `pull_request`. `cache-from` stays unconditional, so
PRs keep reading main's warm cache and the ~200MB torch CPU-wheel layer
is still not re-downloaded; on run 34217523633 (push to main, warm
cache) the whole job took 242s with the export included.

The `timeout-minutes: 13` comment cited "run 33951959734, max 369s" as
its basis; today's 827s observation invalidates that as an upper bound.
It is re-sourced to the warm-path steady state it actually bounds, and
records explicitly that the cold `mode=max` export is removed rather
than budgeted for.

The two sibling Docker Build jobs already used `mode=min`; this job was
the odd one out.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01StMBvNd7eVJGtpnC2zNsx1