bench(core): Tier-1 criterion microbenchmarks for the punktfunk/1 hot path

GPU-free, so they run in normal CI. Two layers: crypto/{seal,seal_in_place,open} on one MTU shard,
and pipeline/{gf8,gf16}/{64KB,1MB} — a whole frame through the real per-frame path end to end over
the loopback transport (FEC encode → AES-GCM seal → packetize → reassemble → FEC decode → open).
Baselines on the dev box (RTX 5070 Ti VM): AES-GCM ~1.57 GiB/s/shard; gf16 ~418 MiB/s at 1 MB vs
gf8 ~23 MiB/s (the GF(2^8) O(n^2) ceiling the GF(2^16) Leopard wall-breaker removes — exactly the
kind of regression this should catch). The GPU capture/NVENC path is out of scope here (Tier 3).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-core/Cargo.toml

@@ -56,6 +56,13 @@ libc = "0.2"
 
 [dev-dependencies]
 proptest = "1"
+# Tier-1 microbenchmarks (benches/pipeline.rs). default-features off → no plotters/HTML (headless
+# CI just needs the measurement + target/criterion/**/estimates.json for the regression compare).
+criterion = { version = "0.5", default-features = false, features = ["cargo_bench_support"] }
+
+[[bench]]
+name = "pipeline"
+harness = false
 
 [build-dependencies]
 cbindgen = "0.29"