fix(bench): dep-bump fixture should reflect post-ignore-filter content (#845)

[gfargo]

Context

The user pointed out that lockfiles should already be auto-skipped — and they're right. DEFAULT_IGNORED_FILES (src/lib/config/constants.ts:5-12) covers package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb, bun.lock, plus node_modules; DEFAULT_IGNORED_EXTENSIONS covers .lock and .map. getChanges strips matching files before the diff-condensing pipeline ever sees them.

The dep-bump fixture from #849 included yarn.lock and reported 27 s / 1 LLM call / 20k prompt tokens for it. That was a bench-fixture artifact, not a real-world cost — and the original "lockfile fast-path" angle from the plan is moot because the existing filter already handles it.

Fix

• Drop yarn.lock from DEP_BUMP_FILES; the realistic post-filter shape is just package.json + CHANGELOG.md.
• Update the dep-bump-shape test to assert the post-filter invariant (no lockfile in the fixture) instead of asserting one is present.
• Add a guard test that fails loudly if any future fixture accidentally drifts back into including a default-ignored file (file basename in DEFAULT_IGNORED_FILES or extension in DEFAULT_IGNORED_EXTENSIONS). Catches this class of mistake at CI time.

Re-captured baseline

fixture	before	after	Δ
dep-bump	27,158 ms	0 ms	-27,158 ms
dep-bump LLM calls	1	0	-1
dep-bump tokens	19,597	0	-19,597

Other fixtures unchanged (re-ran for completeness; numbers within ms of prior baseline). The new full baseline is committed at .bench/baseline.json.

Plan implication

The original #845 plan listed a "lockfile fast-path" optimization angle. Dropped — the existing ignore filter already handles it; any pipeline-level skip would be redundant. The remaining optimization plan stands as-is.

Test plan

• npm run lint
• npm run test:jest (1250 tests pass — added guard test + updated dep-bump shape assertion)
• npm run build
• npm run test:cli
• npm run bench --update → dep-bump now reports 0ms / 0 calls