Tighten macOS performance budgets after eliminating the 30-second tail

[karthiknadig]

Problem

The macOS performance budgets added in #503 were calibrated while the deterministic /usr/bin/python3 probe tail was still present. They intentionally allow very large tail changes:

• server startup P95: 10,000ms absolute / 100% relative
• full refresh P95: 5,000ms absolute / 25% relative
• time to first environment P95: 10,000ms absolute / 100% relative

PR #506 eliminates that tail. Its two final validations report:

Metric	Run 1	Run 2	Existing baseline
Full refresh P95	1,435ms	1,256ms	30,320ms
Server startup P95	691ms	-	7,356ms
Time to first environment P95	745ms	-	7,433ms

With a post-fix baseline near 1-1.5 seconds, the current absolute budgets could allow a multi-second regression before blocking. That would normalize away much of #506's improvement.

Scope

After #506 merges and successful exact-base baseline artifacts exist:

• inspect repeated post-fix macOS baselines and hosted-runner variance;
• tighten macOS startup, refresh, and time-to-first P95 budgets with measured headroom;
• retain the dual absolute/relative rule so small noisy changes do not fail;
• update comparator tests and docs/QUALITY_SNAPSHOTS.md;
• leave Linux and Windows budgets unchanged unless new evidence independently justifies a change.

Acceptance criteria

• Missing or malformed metrics continue to fail closed.
• Synthetic regressions beyond each new macOS limit fail tested comparator cases.
• Repeated unchanged-head macOS runs remain green.
• A recurrence of a 15-second interpreter probe tail is unambiguously blocked.
• Full lint, CI, coverage, performance, and CodeQL checks pass.

Depends on #506.

[karthiknadig]

Post-merge baseline run 31502938210 succeeded at f0c62d9 with macOS P95 values of 621ms startup, 1,343ms full refresh, and 649ms time-to-first environment. Combined with the three unchanged-content PR measurements:

Measurement	Startup P95	Refresh P95	Time-to-first P95
PR validation 1	574ms	1,420ms	592ms
PR validation 2	691ms	1,435ms	745ms
PR repeat	537ms	1,256ms	575ms
Merged baseline	621ms	1,343ms	649ms

Observed ranges are 154ms, 179ms, and 170ms respectively. Proposed dual budgets:

• startup P95: 750ms absolute / 100% relative
• full refresh P95: 1,000ms absolute / 50% relative
• time-to-first P95: 750ms absolute / 100% relative

Against the merged baseline, those block above roughly 1,371ms, 2,343ms, and 1,399ms. This leaves 4-6x the observed run-to-run range as absolute headroom while reducing the old allowed ceilings of ~10.6s/~6.3s/~10.6s. Tests will prove the observed worst runs pass and 1.5s/2.5s/1.5s synthetic regressions fail.

[karthiknadig]

Final quality conclusion for PR #508 at 412b102:

• Exact-head Copilot review: 3/3 files, 0 comments, 0 unresolved threads.
• Comparator suite: 22/22 passed; the worst calibration artifact passes and synthetic 1.5s/2.5s/1.5s macOS P95 regressions fail.
• macOS gate passed a noisy hosted run: startup P95 1,036ms vs 621ms baseline, refresh P95 2,099ms vs 1,343ms, and time-to-first P95 1,094ms vs 649ms. Each remains inside the new dual budget, demonstrating measured headroom.
• Linux performance passed: refresh P50/P95 58ms/344ms vs 55ms/311ms.
• Windows failed once on a single 16.6s cold iteration, while nine warm iterations and all diagnostics were 133-176ms. The failed-job rerun passed; this benchmark-design issue is tracked separately in Make cold-refresh performance snapshots statistically robust #509 rather than weakening test: tighten post-fix macOS performance budgets (Fixes #507) #508's budgets.
• Inventories match on all platforms and interpreter timeout maps are empty.
• Linux/Windows line and function coverage are unchanged; CodeQL and all substantive CI workflows pass.

Two individual job check records remain stale as in_progress, but their logs show successful test completion/cleanup and both parent workflows conclude success.