ci(performance): fail when the web app's initial bytes grow (#1694)

Third step of the performance-journeys ratchet, stacked on #1693 (which is stacked on #1692; merge in order, GitHub retargets each to `master`).

- New `Initial bytes ratchet` job in `.github/workflows/ci.yml` (ubuntu-latest): install, `pnpm nx build web --skip-nx-cache` (production configuration, the one users download), then `pnpm run perf:initial-bytes:check`. The job fails when `renderer.initialBytes` exceeds `tools/performance/journey-baselines.json`.
- `dist/performance/` is uploaded as the `performance-journey-summary` artifact on every run, so a failing or tightenable run carries its evidence.
- After review: the job first runs the new `tools/performance/check-baseline-direction.mjs`, which compares `journey-baselines.json` with the revision the change is measured against (the target branch of a pull request, `github.event.before` for a `master` push, `master` for a manual dispatch) and fails on any raised enforced limit (`value × toleranceRatio`), any widened or newly added tolerance, or any removed entry, so a PR cannot grow the payload and raise the baseline to match (lowered limits and new entries pass; a target branch without the file has nothing to weaken). Node tests cover it.
- Docs: the performance-journeys contract and the validation map name the job, and the contract now states that this runner is the canonical measurer (take baseline values from its output, not from a local build).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -126,6 +126,85 @@ jobs:
                   CI: true
                   NX_TASKS_RUNNER_DYNAMIC_OUTPUT: false
 
+    initial-bytes-ratchet:
+        name: Initial bytes ratchet
+        runs-on: ubuntu-latest
+        timeout-minutes: 30
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v7
+
+            - name: Install pnpm
+              uses: pnpm/action-setup@v6.0.10
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v7
+              with:
+                  node-version-file: '.nvmrc'
+                  cache: 'pnpm'
+
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            # The ratchet below compares a measurement with the baselines file
+            # of the same commit, so it cannot see a change that grows the
+            # payload and raises the baseline to match. Compare the file with
+            # the revision this one is measured against instead: the target
+            # branch for a pull request, the previous head for a master push,
+            # master for a manual dispatch. Any raised limit, widened tolerance
+            # or removed entry fails.
+            - name: Refuse baseline increases against the previous revision
+              env:
+                  EVENT_NAME: ${{ github.event_name }}
+                  BASE_REF: ${{ github.base_ref }}
+                  BEFORE_SHA: ${{ github.event.before }}
+              run: |
+                  set -euo pipefail
+                  case "$EVENT_NAME" in
+                      pull_request)
+                          git fetch --no-tags --depth=1 origin "$BASE_REF"
+                          ;;
+                      push)
+                          if [ -z "$BEFORE_SHA" ] || [ "$BEFORE_SHA" = "0000000000000000000000000000000000000000" ]; then
+                              echo "No previous revision for this push; nothing to compare against."
+                              exit 0
+                          fi
+                          git fetch --no-tags --depth=1 origin "$BEFORE_SHA"
+                          ;;
+                      *)
+                          git fetch --no-tags --depth=1 origin master
+                          ;;
+                  esac
+                  git show "FETCH_HEAD:tools/performance/journey-baselines.json" > /tmp/base-journey-baselines.json 2>/dev/null ||
+                      rm -f /tmp/base-journey-baselines.json
+                  node tools/performance/check-baseline-direction.mjs \
+                      --base /tmp/base-journey-baselines.json \
+                      --head tools/performance/journey-baselines.json
+
+            # The production configuration is what users download; measuring
+            # any other build would ratchet a number nobody ships.
+            - name: Build web app (production)
+              run: pnpm nx build web --skip-nx-cache
+              env:
+                  CI: true
+                  NX_TASKS_RUNNER_DYNAMIC_OUTPUT: false
+
+            # Fails when renderer.initialBytes exceeds the value committed in
+            # tools/performance/journey-baselines.json. Baselines only move
+            # down, with the printed measurement as evidence; the contract is
+            # docs/architecture/performance-journeys.md.
+            - name: Check renderer.initialBytes against the baseline
+              run: pnpm run perf:initial-bytes:check
+
+            - name: Upload journey summary
+              if: always()
+              uses: actions/upload-artifact@v7
+              with:
+                  name: performance-journey-summary
+                  path: dist/performance/
+                  retention-days: 14
+
     unit-and-typecheck:
         name: Unit Tests and Typechecks
         runs-on: ubuntu-latest