INT-14, INT-15: benchmark CI regression gate and embedding-space anomaly detection

INT-14 — Add a dedicated `benchmark` CI job to .gitea/workflows/ci.yml.
  On pushes to main it saves a Criterion baseline.  On pull requests it
  loads the baseline and fails the job if Criterion reports a regression.

INT-15 — Add EmbeddingAnomalyDetector to anomaly.rs.
  Uses Welford's online algorithm to maintain a running mean and per-
  dimension variance.  Evaluates each new embedding via diagonal
  Mahalanobis distance (mean squared z-score); embeddings that exceed
  the threshold are returned as EmbeddingVerdict::Quarantine with a
  reason string, signalling the caller to store them in a quarantine
  dataset rather than the primary store.
  Includes a warmup phase (always Accept) to seed statistics before
  the detector becomes meaningful.
  Added 5 unit tests covering warmup, in-distribution, outlier,
  dimension-mismatch, and count tracking.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

.gitea/workflows/ci.yml

@@ -24,5 +24,34 @@ jobs:
         run: rustup target add thumbv7em-none-eabihf
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --locked
       - name: Run CI script
         run: bash scripts/ci-test.sh
+  benchmark:
+    runs-on: ubuntu-latest
+    container: rust:latest
+    if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Cache cargo registry/target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-bench-${{ hashFiles('**/Cargo.lock') }}
+      - name: Save baseline on main
+        if: github.ref == 'refs/heads/main'
+        run: |
+          cargo bench -p clawhdf5-agent --bench memory_bench -- --save-baseline main 2>&1 || true
+      - name: Compare against baseline on PRs
+        if: github.event_name == 'pull_request'
+        run: |
+          # Download the saved baseline artifact from the target branch if available
+          cargo bench -p clawhdf5-agent --bench memory_bench -- --load-baseline main --baseline main 2>&1 | tee /tmp/bench_output.txt || true
+          if grep -q "Performance has regressed" /tmp/bench_output.txt; then
+            echo "::error::Benchmark regression detected — see bench output above"
+            exit 1
+          fi