feat(matrix): benchmark multiple wallarm builds side-by-side

[w-kerman]

Summary

• Passing WALLARM_IMAGE as a comma-separated list (e.g. wallarm:branch-main,wallarm:branch-other) now expands the wallarm gateway column into one wallarm@<variant> column per image — two or more builds race through the same canonical matrix in a single sweep.
• Single-value WALLARM_IMAGE is unchanged; column stays wallarm, no breaking change to existing pipelines.
• Variant label is derived from the image tag (chars after the last :), sanitised for docker, with -N disambiguation on duplicates.

How it works

• orchestrator/internal/matrix learns WallarmVariant, ParseWallarmImageEnv, ExpandWallarmVariants, WallarmImageFor, plus Cell.GatewayBase() / Cell.GatewayVariant() helpers.
• bench run reads WALLARM_IMAGE from the env and threads variants into both --matrix selection and --matrix canonical expansion.
• runner.Runner injects WALLARM_IMAGE=<cell image> per cell and, when the gateway carries an @variant suffix, forces a docker-safe BENCH_CONTAINER_PREFIX / BENCH_COMPOSE_PROJECT (@ is illegal in container_name).
• scripts/load-gateway.sh and scripts/aws-clean-cell.sh strip the @variant to resolve gateways/<base>/docker-compose.yaml, the per-policy setup.sh, FEATURE-MISSING*, and .env. Per-cell artefacts still land at reports/<run-id>/raw/wallarm@<variant>/....
• Report ordering treats wallarm@* as the wallarm canonical rank with alphabetical tiebreak so variant columns sit next to each other; manifest's image probe resolves against the base directory.

Example

```bash
WALLARM_IMAGE='wallarm:branch-main,wallarm:branch-other' \
orchestrator/bin/bench run --gateways wallarm,nginx --matrix canonical

columns: nginx, wallarm@branch-main, wallarm@branch-other

```

Test plan

• `go test ./...` in `orchestrator/` (5 new test cases in `matrix_test.go` covering parse / expand / sort / cell helpers + canonical expansion)
• `go vet ./...` clean
• `bash -n` on `scripts/load-gateway.sh` and `scripts/aws-clean-cell.sh`
• `bench run --dry-run` plans the right cell count with `WALLARM_IMAGE='a,b' --gateways wallarm,nginx --matrix canonical --loads p1-baseline` (39 = 13×3 cells)
• Single-value `WALLARM_IMAGE` still produces a plain `wallarm` column (no breaking change)
• End-to-end AWS sweep with two real wallarm images to confirm compose-up, container naming, and report rendering

🤖 Generated with Claude Code