Phase 4a sub-commit 5: performance-smoke harness + 4a closure

examples/todo/tests/perfsmoke.sh asserts the PLAN.md §11 budgets
against the built AppImage:

  - Bundle size ≤ 200 MB (hard cap; ≤ 120 MB target)
  - Cold start ≤ 2000 ms from launch to first /healthz 200
  - Idle RSS (host + descendants in the process group) ≤ 200 MB after
    a 2 s settle.

Each budget is overridable via env (PERF_COLD_START_MS etc.) for slow
shared CI runners; defaults are the strict numbers from the plan. Runs
the AppImage under xvfb-run when DISPLAY is unset; falls back to
QT_QPA_PLATFORM=offscreen otherwise (the build script already bundles
libqoffscreen.so via EXTRA_PLATFORM_PLUGINS).

Wired into:
  - examples/todo/Makefile  → `make perf`
  - .gitea/workflows/release.yml → runs after AppImage build, before
    zsync + upload, with cold-start budget bumped to 4 s for CI.

CI now also installs zsync + xvfb in one step.

examples/todo/README.md gains an "AppImage packaging (Phase 4a)"
section walking through `make appimage`, bundled-mode behaviour, the
auto-update QML hooks (BackendConnection.checkForUpdates() / applyUpdate()),
and `make perf`.

PLAN.md §13 Phase 4 marked **4a closed**. 4b (macOS) and 4c (Windows)
stay stubs until their runners + certs exist.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

PLAN.md

@@ -804,6 +804,8 @@ Sub-phases 4b and 4c are scoped in their own `Phase 4b` / `Phase 4c` entries in
 - `BackendConnection.checkForUpdates()` invoked from the menu finds a newer release and updates in place.
 - The performance-smoke harness reports cold-start / memory / render-time numbers within budget on every release build.
 
+**4a status: closed (commits a1cc06a → 4a-sub-5).** Ship-readiness on Linux. macOS (4b) and Windows (4c) remain stubs in this section; their entries get filled in once self-hosted runners and platform certs land.
+
 ### Phase 5 — DX polish
 
 - Project skeleton via Composer / a small CLI to scaffold a new app.