perf(round26): drive-policy JSONB decode, CachedBlobBackend shard-dir pre-create, delta-upload foldhash

Three benchmark-gated optimizations from the ROUND25 backlog (benches/ROUND26.md),
each with a BEFORE/AFTER gate that rolls back if AFTER does not beat BEFORE:

- P1 drive_pg_repository policy reads: decode d.policies through
  sqlx::types::Json<DrivePolicies> (one from_slice over the raw JSONB bytes)
  instead of a throwaway serde_json::Value DOM + DrivePolicies::from_value —
  6 -> 0 allocs/read, 2.77x wall. A shared policies_from_row helper preserves
  the lenient unwrap_or_default fallback (malformed bag -> all-false).
- D1 CachedBlobBackend: pre-create the 256 {00..ff} shard dirs at initialize()
  (mirroring LocalBlobBackend, reusing HEX_PREFIXES) and drop the redundant
  per-write create_dir_all on already-existing shards — ~45us + a blocking-pool
  dispatch removed per cache write on cached-remote deployments.
- G1 delta-upload have/need hash sets (distinct_hashes, authorize_chunk_download):
  SipHash -> foldhash::quality::RandomState — a fast hasher that stays
  DoS-resistant via a per-instance random seed, the required property for the
  attacker-controlled 64-hex client hashes — 2.37x wall on a 40k-hash
  negotiation. foldhash was already in the lockfile transitively (hashbrown).

Tested and REVERTED (kept as-is): moving the moka eviction unlink off the reactor
via spawn_blocking. The benchmark refuted it — on the local cache dir the
spawn_blocking dispatch (~20us) costs more than the inline unlink (~7us) it would
replace. See ROUND26.md §D2.

Adds bench_round26_{micro,diskio,hasher} (counting allocator / async wall / wall).
Verified: cargo fmt clean, cargo clippy --features bench -D warnings clean,
cargo test --lib --features bench = 529 passed / 0 failed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L8gs91AhmazoxMsDcNk3KT

Cargo.toml

@@ -85,6 +85,10 @@ infer = "0.19"
 async-compression = { version = "0.4.42", features = ["tokio", "gzip"] }
 async_zip = { version = "0.0.18", features = ["tokio", "deflate"] }
 dashmap = "6.2.1"
+# Fast, DoS-resistant (per-instance random-seeded) hasher for trusted- and
+# attacker-controlled internal maps/sets. Already present transitively via
+# hashbrown, so this direct dep adds no new compiled crate (benches/ROUND26.md §G1).
+foldhash = "0.2"
 socket2 = { version = "0.6.4", features = ["all"] }
 urlencoding = "2.1.3"
 utoipa = { version = "5.5.0", features = ["axum_extras", "uuid", "chrono"] }
@@ -354,6 +358,32 @@ name = "bench_micro_allocs"
 path = "examples/bench_micro_allocs.rs"
 required-features = ["bench"]
 
+# Round-26 battery ────────────────────────────────────────────────────────────
+
+# Round-26 CPU/alloc micro-pack (no Postgres) — drive-policy JSONB decode through
+# a throwaway serde_json::Value DOM → from_slice::<DrivePolicies> (P1, the §J1
+# pattern applied to the drive-policy path §J2 left behind).
+[[example]]
+name = "bench_round26_micro"
+path = "examples/bench_round26_micro.rs"
+required-features = ["bench"]
+
+# Round-26 disk-I/O pack — CachedBlobBackend redundant per-write create_dir_all
+# on warm shards → pre-create the 256 shard dirs at init (D1). (D2, moving the
+# eviction unlink off the reactor via spawn_blocking, was tested and REVERTED —
+# spawn_blocking dispatch costs more than the fast local unlink; see ROUND26.md.)
+[[example]]
+name = "bench_round26_diskio"
+path = "examples/bench_round26_diskio.rs"
+required-features = ["bench"]
+
+# Round-26 hasher pack — delta-upload have/need hash sets: SipHash → foldhash
+# (per-instance random-seeded, DoS-safe for the attacker-controlled hashes) (G1).
+[[example]]
+name = "bench_round26_hasher"
+path = "examples/bench_round26_hasher.rs"
+required-features = ["bench"]
+
 # Round-25 battery ────────────────────────────────────────────────────────────
 
 # Round-25 CPU/alloc/RAM micro-pack (no Postgres) — deterministic alloc+bytes