test(redaction): calibrate the perf growth sizes so the assertions cannot fail on a fast box

[andrei-hasna]

CI on the release PR (#21) caught a defect I shipped in #20, and it is the same defect class that PR was written to fix, pointing the other way.

the cookie rule stays linear as a single unbroken RUN grows failed on the GitHub runner while the implementation is perfectly linear. Fixed at 8/16/32 KiB, a fast quiet runner finishes those sizes in a fraction of a millisecond, and at that scale timer resolution and JIT noise dominate the ratio.

#20 replaced a perf test that could not FAIL with one that could not reliably PASS. A test that fails when nothing is wrong is exactly as useless as one that passes when something is — and worse in one respect: it trains people to re-run CI until it goes green, which is how a real failure gets waved through.

The fix

Calibrate the smallest size to the machine rather than fixing it, then measure across three doublings from there. The two cases separate themselves with no change to the 2.8 threshold, which is the part that must not move:

• a linear implementation is fast, so calibration keeps doubling and ends up measuring where the numbers are solid;
• a quadratic one is already far above the floor at the smallest size, so calibration stops immediately and the assertion fails at small sizes and therefore fast — a test that can only fail by timing out reports its budget rather than a duration.

Applied to growthPerDoubling as well, because it is the same family and the same flake: the pre-existing Digest control failed 1 run in 8 here at loadavg 25, and an adversarial reviewer measured it at 2 in 10 before the estimator changed.

Verified in both directions

fix     10 of 10 consecutive full-suite runs green, loadavg 24.5
mutant  ratio 4.012 — FAILS — in 30.1s

The mutant is redactCookiePairs replaced by the naive /([^\s;,=]+)=([^\s;,]*)/g that the rule was restructured to avoid. typecheck rc=0.

Test-only change — src/ is untouched, so no redaction behaviour moves.

Why this is blocking something

@hasna/tai on the registry is 0.1.4, which emits every session cookie it is asked to redact. Main carries the fixes for that (#19, #20) but is unpublished; the release PR #21 is blocked on this flake. Landing this unblocks the release.

Refs: todos 6200c4e4

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}