test: add benchmark suite

[Taure]

Summary

Benchmark suite for measuring shigoto performance across key operations.

Results (local, pool_size=5, PostgreSQL in Docker)

Benchmark	Jobs	Avg	Throughput
insert_single	1,000	0.71 ms/job	1,417/sec
insert_bulk_100	10,000	0.09 ms/job	10,725/sec
insert_bulk_1000	10,000	0.10 ms/job	10,124/sec
insert_unique	1,000	1.93 ms/job	517/sec
claim+complete	1,000	2.77 ms/job	361/sec
claim+complete 4x	2,000	0.73 ms/job	1,375/sec
full_lifecycle	500	3.64 ms/job	274/sec
10_queues	1,000	4.05 ms/job	247/sec
encrypted	1,000	0.83 ms/job	1,201/sec
with_deps	500	1.16 ms/job	861/sec

Run with: rebar3 ct --suite shigoto_bench_SUITE

Test plan

• All 10 benchmarks pass
• Results written to /tmp/shigoto_bench.txt

[github-actions]

🟠 Code Coverage — 53%

643 of 1214 lines covered.

---

🟡 ELP Lint —

2 diagnostics found. See job logs for details.

---

✅ ELP eqWAlize

No diagnostics.

---

ℹ️ 11 OTP CVEs auto-ignored (already fixed in running version)

These CVEs are patched in the installed OTP version but NVD data
has not been updated to reflect this. They are excluded from the
scan via an auto-generated .trivyignore.

CVE	Details
CVE-2026-23943	Fixed in 28.4.1, running 28.4.1 — Pre-auth SSH DoS via unbounded zlib inflate
CVE-2026-23942	Fixed in 28.4.1, running 28.4.1 — SFTP root escape via component-agnostic prefix check in ssh_sftpd
CVE-2026-23941	Fixed in 28.4.1, running 28.4.1 — Request smuggling via first-wins Content-Length parsing in inets httpd
CVE-2026-21620	Fixed in 28.3.2, running 28.4.1 — TFTP Path Traversal
CVE-2016-1000107	Fixed in 28.0.4, running 28.4.1 — Httpd CGI Scripts Environment Variable Pollution AKA "httpoxy"
CVE-2025-58050	Fixed in 28.0.3, running 28.4.1 — Buffer Read Overflow on Regular Expressions with (*scs:) and (*ACCEPT)
CVE-2025-48038	Fixed in 28.0.3, running 28.4.1 — SSH Unverified File Handles can Cause Excessive Use of System Resources
CVE-2025-48039	Fixed in 28.0.3, running 28.4.1 — SSH Unverified Paths can Cause Excessive Use of System Resources
CVE-2025-48040	Fixed in 28.0.3, running 28.4.1 — SSH Malicious Key Exchange Messages may Lead to Excessive Resource Consumption
CVE-2025-48041	Fixed in 28.0.3, running 28.4.1 — SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles
CVE-2025-4748	Fixed in 28.0.1, running 28.4.1 — Absolute Path in Zip Module