perf(isolation): add TCP and DNS benchmark harnesses

[drew]

Summary

Add benchmark harnesses for the final RFC 0012 stack so reviewers can measure the cost of sandbox startup, DNS mediation, TCP connection establishment, sustained TCP traffic, policy denial, and representative live-Internet workloads.

This is the final PR in the stack and contains measurement tooling only. General application UDP mediation is intentionally out of scope; DNS continues to support UDP and TCP internally through the supervisor.

Related Issue

Part of #1737.

Changes

• Add a focused seccomp TCP/DNS microbenchmark binary behind the perf-harness feature.
• Add live-Internet and end-to-end network performance scenarios.
• Add a mise run perf:seccomp entry point.
• Keep benchmark code isolated from the production runtime and driver PRs below it.

Testing

• mise run pre-commit passes
• Full benchmark runs deferred to remote CI / dedicated benchmark hosts
• Driver E2E reruns deferred to remote CI

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

Review remediation

• Remove unused fixture context while preserving the benchmark-only layer boundary.

Stack

1. feat(isolation): define the RFC 0012 boundary contract #2941 — contract
2. feat(isolation): add boundary protocol and Linux primitives #2942 — shared interface and primitives
3. feat(isolation): split supervisor and sandbox runtimes #3151 — supervisor and sandbox runtimes
4. feat(vm): run the supervisor outside the guest workload #2945 — VM driver
5. feat(docker): isolate workloads behind the host supervisor #2965 — Docker driver
6. feat(kubernetes): add proxy-pod isolation topology #3144 — Kubernetes proxy-pod topology
7. feat(podman): isolate workloads behind the host supervisor #3230 — Podman driver
8. perf(isolation): add TCP and DNS benchmark harnesses #3229 — performance harnesses (this PR)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/3229 does not exist yet. A maintainer needs to comment /ok to test ef9f882d2b4cddc495f5489638ee2506c237cd38 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3229.docs.buildwithfern.com/openshell