#12 Harden streaming, LOD, and benchmark validation

Summary

This PR hardens the existing charting implementation for the next alpha-validation phase.

What changed

• Fixes deterministic LOD timing and reproduces the remote drill-thrash regression locally.
• Replaces repeated streaming channel concatenation with amortized capacity buffers and monotonic domains.
• Adds positive zone statistics through ABI v11 for efficient logarithmic autorange.
• Adds zone-pruned scatter selection and real wall-clock worker-density coverage.
• Deduplicates tooltip/channel binding and component mark rollback paths.
• Adds hostile-input hardening for line/area sorting and density histograms.
• Makes CodSpeed reproducible through a declared optional dependency, lockfile, runbook, and workflow checks.
• Adds a required 1M-point log-autorange workflow benchmark alongside streaming and density rebuild workloads.

Review follow-ups

• Restores the swallowed append-channel negative-path assertions to their original test.
• Intersects zone candidates at chunk granularity before expanding row IDs.
• Repairs a rebound continuous-channel prefix before reusing a capacity buffer.
• Makes the worker probe skip cleanly when Node is unavailable and increases its cold-run timeout to 60 seconds.
• Avoids the unnecessary finite-value compaction on the integer histogram fast path.
• Removes the duplicate declarative category snapshot and documents selection-order semantics.
• Documents normalized view-change callback windows.

Validation

• 949 Python tests passed.
• 61 Rust tests passed, including clippy and release build.
• 72 ABI smoke checks passed.
• Strict hostile-input suite passed: 137 tests with RuntimeWarnings treated as errors.
• Browser LOD, visual, lifecycle, interaction, and worker-density gates passed.
• CodSpeed local suite passed: 28/28 benchmarks.
• Standard workflow pilot passed with 1M-point streaming, 2.1M-point density rebuild, and 1M-point log autorange workloads.

Note

The remote CodSpeed action previously executed all benchmarks but could not upload results because the private organization subscription was unavailable. The workflow and local benchmark setup are ready; organization billing/access still needs to be enabled separately.