Phase 4a sub-commit 5: performance-smoke harness + 4a closure

examples/todo/tests/perfsmoke.sh asserts the PLAN.md §11 budgets
against the built AppImage:

  - Bundle size ≤ 200 MB (hard cap; ≤ 120 MB target)
  - Cold start ≤ 2000 ms from launch to first /healthz 200
  - Idle RSS (host + descendants in the process group) ≤ 200 MB after
    a 2 s settle.

Each budget is overridable via env (PERF_COLD_START_MS etc.) for slow
shared CI runners; defaults are the strict numbers from the plan. Runs
the AppImage under xvfb-run when DISPLAY is unset; falls back to
QT_QPA_PLATFORM=offscreen otherwise (the build script already bundles
libqoffscreen.so via EXTRA_PLATFORM_PLUGINS).

Wired into:
  - examples/todo/Makefile  → `make perf`
  - .gitea/workflows/release.yml → runs after AppImage build, before
    zsync + upload, with cold-start budget bumped to 4 s for CI.

CI now also installs zsync + xvfb in one step.

examples/todo/README.md gains an "AppImage packaging (Phase 4a)"
section walking through `make appimage`, bundled-mode behaviour, the
auto-update QML hooks (BackendConnection.checkForUpdates() / applyUpdate()),
and `make perf`.

PLAN.md §13 Phase 4 marked **4a closed**. 4b (macOS) and 4c (Windows)
stay stubs until their runners + certs exist.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

examples/todo/tests/perfsmoke.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# perfsmoke.sh — assert PLAN.md §11 *Performance budgets* against the
+# built AppImage. Run via `make perf` or as a CI step before publishing
+# a release. The numbers below are the budgets; override via env vars
+# when measuring on slow shared runners (with care — they exist for a
+# reason).
+
+set -euo pipefail
+
+APPIMAGE="${1:-$(dirname "${BASH_SOURCE[0]}")/../build/Todo-x86_64.AppImage}"
+APPIMAGE="$(readlink -f "$APPIMAGE")"
+[ -x "$APPIMAGE" ] || { echo "AppImage not found: $APPIMAGE" >&2; exit 1; }
+
+: "${PERF_COLD_START_MS:=2000}"
+: "${PERF_IDLE_MEM_MB:=200}"
+: "${PERF_BUNDLE_MB:=200}"
+: "${PERF_BACKEND_PORT:=8765}"
+: "${PERF_HEALTHZ_DEADLINE_MS:=5000}"
+
+DATA_DIR="$(mktemp -d)"
+trap 'cleanup' EXIT INT TERM
+
+PID=""
+cleanup() {
+    trap - EXIT INT TERM
+    if [ -n "$PID" ] && kill -0 "$PID" 2>/dev/null; then
+        kill -TERM "$PID" 2>/dev/null || true
+        for _ in 1 2 3 4 5 6 7 8 9 10; do
+            kill -0 "$PID" 2>/dev/null || break
+            sleep 0.2
+        done
+        kill -KILL "$PID" 2>/dev/null || true
+    fi
+    rm -rf "$DATA_DIR"
+}
+
+step() { echo "→ $*"; }
+fail() { echo "✗ $*" >&2; exit 1; }
+
+# ── Bundle size ──────────────────────────────────────────────────────
+SIZE_BYTES=$(stat -c %s "$APPIMAGE")
+SIZE_MB=$(( SIZE_BYTES / 1024 / 1024 ))
+step "bundle size: ${SIZE_MB} MB (cap ${PERF_BUNDLE_MB} MB)"
+[ "$SIZE_MB" -le "$PERF_BUNDLE_MB" ] || fail "bundle ${SIZE_MB} MB exceeds ${PERF_BUNDLE_MB} MB"
+
+# ── Boot under Xvfb if no display is available ───────────────────────
+RUNNER=()
+if [ -z "${DISPLAY:-}" ]; then
+    if command -v xvfb-run >/dev/null; then
+        RUNNER=(xvfb-run -a)
+    else
+        # Fall back to Qt's offscreen platform (the AppImage build
+        # bundles libqoffscreen.so via EXTRA_PLATFORM_PLUGINS).
+        export QT_QPA_PLATFORM=offscreen
+        echo "no DISPLAY / xvfb-run — falling back to QT_QPA_PLATFORM=offscreen" >&2
+    fi
+fi
+
+# Use an isolated user data dir so the smoke doesn't trample dev state.
+export XDG_DATA_HOME="$DATA_DIR/share"
+export XDG_CACHE_HOME="$DATA_DIR/cache"
+export APPIMAGE_EXTRACT_AND_RUN=1
+mkdir -p "$XDG_DATA_HOME" "$XDG_CACHE_HOME"
+
+step "launching AppImage (${RUNNER[*]:-direct})"
+START_NS=$(date +%s%N)
+"${RUNNER[@]}" "$APPIMAGE" > "$DATA_DIR/run.log" 2>&1 &
+PID=$!
+
+# ── Cold start: time to first /healthz 200 ───────────────────────────
+DEADLINE_NS=$(( START_NS + PERF_HEALTHZ_DEADLINE_MS * 1000000 ))
+ELAPSED_MS=""
+while true; do
+    NOW_NS=$(date +%s%N)
+    if [ "$NOW_NS" -ge "$DEADLINE_NS" ]; then
+        sed 's/^/    /' "$DATA_DIR/run.log" >&2 || true
+        fail "cold start exceeded ${PERF_HEALTHZ_DEADLINE_MS} ms deadline"
+    fi
+    if ! kill -0 "$PID" 2>/dev/null; then
+        sed 's/^/    /' "$DATA_DIR/run.log" >&2 || true
+        fail "host died during boot"
+    fi
+    if curl -fsS -m 1 "http://127.0.0.1:${PERF_BACKEND_PORT}/healthz" >/dev/null 2>&1; then
+        END_NS=$(date +%s%N)
+        ELAPSED_MS=$(( (END_NS - START_NS) / 1000000 ))
+        break
+    fi
+    sleep 0.05
+done
+step "cold start: ${ELAPSED_MS} ms (budget ${PERF_COLD_START_MS} ms)"
+[ "$ELAPSED_MS" -le "$PERF_COLD_START_MS" ] \
+    || fail "cold start ${ELAPSED_MS} ms exceeds ${PERF_COLD_START_MS} ms"
+
+# ── Idle memory: measure host + descendants after a 2 s settle ───────
+sleep 2
+TOTAL_KB=0
+PGID=$(ps -o pgid= -p "$PID" | tr -d ' ')
+while IFS= read -r p; do
+    [ -r "/proc/$p/status" ] || continue
+    R=$(awk '/^VmRSS:/ {print $2}' "/proc/$p/status" 2>/dev/null || echo 0)
+    TOTAL_KB=$(( TOTAL_KB + R ))
+done < <(pgrep -g "$PGID" 2>/dev/null)
+TOTAL_MB=$(( TOTAL_KB / 1024 ))
+step "idle memory (host + children): ${TOTAL_MB} MB (budget ${PERF_IDLE_MEM_MB} MB)"
+[ "$TOTAL_MB" -le "$PERF_IDLE_MEM_MB" ] \
+    || fail "idle memory ${TOTAL_MB} MB exceeds ${PERF_IDLE_MEM_MB} MB"
+
+echo
+echo "✓ perf smoke OK — bundle=${SIZE_MB}MB cold=${ELAPSED_MS}ms idle=${TOTAL_MB}MB"