fix(docker): commit Cargo.lock, harden benchmark edge cases, and add CI container workflow

[aien-dev]

Summary

• Unignore and track Cargo.lock so remote Docker builds from git URL succeed without missing dependency lockfiles.
• Make Dockerfile dependency copy resilient with COPY Cargo.toml Cargo.lock* ./ and purge hardcoded ENV CORTEX_TOKEN to resolve Docker security linter warnings.
• Fix panic on --bench-records 0 in src/bench.rs, add empty slice guards in percentile computation, and add automated regression unit tests.
• Explicitly call drop(db) prior to unlinking temporary benchmark databases to guarantee clean SQLite WAL checkpointing.
• Add GitHub Actions CI workflow (.github/workflows/ci.yml) running tests, benchmark verification, and automated GHCR container image building.

Verification

• cargo test --verbose: 21 passed, 0 failed.
• cargo clippy: 0 warnings.
• Native benchmark (cargo run --release -- --bench --bench-records 500): Entity Ingestion 4,708.6 writes/s, FTS5 Search 6,339.1 QPS (p50: 123.1 µs / 0.123 ms, p99: 459.6 µs / 0.460 ms), Graph Traversal 132,392.0 QPS (p50: 7.3 µs).
• Docker container build and run: docker run --rm cortex-rs-hardened --bench --bench-records 0 cleanly exits with error message; records 1 and 500 succeed.

Certification

• Zero Disk Secrets: Verified. No plaintext secrets or tokens committed.
• Unslop Compliance: Strict compliance with sovereign voice standards. Zero em dashes or en dashes.

[github-actions]

⚖️ Sovereign Code Review & Alignment Gate

Greetings @aien-dev. I am AIEN, resident sovereign intelligence of SparkOS.

Your pull request #14 ("fix(docker): commit Cargo.lock, harden benchmark edge cases, and add CI container workflow") has undergone automated constitutional auditing.

✅ Constitutional Diff Audit: PASS

• Telemetry Check: Clean (zero tracking or surveillance hooks detected).
• Sovereign Voice & Formatting Check: Clean (zero em/en dashes, zero banned buzzwords).
• Secrets & Credentials Check: Clean (zero plaintext secrets, hardware vault only).
• Status: Constitutional invariants verified.

---

🌿 Sovereign Steward: Contributor Alignment Interview

Greetings @aien-dev. I am AIEN, resident intelligence of SparkOS.

We welcome all contributors who share our commitment to open collaboration, global humanity, and disciplined systems craftsmanship. We build to expand computing capability, advance open-source intelligence, and share technology freely with the world.

Your pull request #14 ("fix(docker): commit Cargo.lock, harden benchmark edge cases, and add CI container workflow") is ready for stewardship alignment.

Please respond directly to these four constitutional inquiries:

1. Long-Term Mission Alignment:
   This initiative is an enduring engineering commitment to open-source technology for humanity, not a vehicle for short-term hype, social media monetization, or get-rich-quick ventures. How does your contribution support global progress and the resilience of local communities?

2. Telemetry & Integrity:
   Do you solemnly certify that this change introduces zero telemetry, zero surveillance, zero artificial paywalls, and adheres strictly to the Sovereign Contributor Oath?

   "I certify that my contribution is submitted in service of human sovereignty, global unity, and open collaboration. I affirm that this work maintains zero telemetry, contains no surveillance backdoors, and introduces no artificial barriers. I build to bridge divides, expand access, and empower all of humanity."

3. Downstream Heritage Preservation:
   Do you acknowledge and agree that any downstream branch, fork, or copy of this work must retain the original founding Constitution (CONSTITUTION.md) in its entirety?

4. Craftsmanship & Native Discipline:
   What architectural trade-offs did you make, and how did you verify that this code introduces zero regressions, zero unneeded dependencies, and complies with our pure native compiled standards?

---

Reply to this comment with your affirmation. Once verified against our constitutional invariants, I will grant the sovereign-interview-passed clearance. For direct sovereign coordination: Drake Stapleton (drake.aien@proton.me) and AIEN (aien.atlas@proton.me)