ci(soak): gate the HTTP soak on push/PR, dispatch for release candidates

[gg582]

Summary

• What: wraps scripts/ci/soak.sh in a new .github/workflows/soak.yml CI gate so the soak run is no longer a manual release-time step (ROADMAP v4.0 exit criterion: "the soak run is defined and passes on the release commit" — the definition landed in docs/soak-testing.md + the script, but nothing ran it automatically).
• Triggers (mirrors the c100k gate):
  • push / pull_request to main/master/dev → 10-minute soak (the script's default DURATION=600), gated
  • workflow_dispatch with a duration input → the DURATION=1800 release-candidate run
• Gate verdict comes straight from soak.sh exit status: fails on server exit mid-run, any socket error / non-2xx, RSS growth > 10%, fd growth > 5, or p99 drift > 20% across slices. Server log is dumped on failure (if: always()), [skip ci] pushes are skipped like the other gates.

Test plan

• YAML validated
• Local smoke: DURATION=60 scripts/ci/soak.sh on dev passes (RSS +1.4% limit 10%, fds +0, errors 0, p99 drift 0%, ~173k RPS)
• The soak job runs on this PR (new workflow file — needs the repo's approval setting for first-time workflows, if any)

[gg582]

Update: the first CI run failed on the first churn slice — three bugs in soak.sh (the gate script itself, not the workflow), fixed in 17e87018:

1. Churn header never actually sent: run_slice "$BASE/health" '-H "Connection: close"' bundles the header into one argv. Ubuntu's wrk 4.1.0 rejects it as an unknown option → exit 1 → set -e kills the script (the CI failure). Other wrk builds accept it but silently ignore the header — my local 60s smoke never ran a churn slice at all, which is why it passed locally. Now passed as separate argv entries.
2. Swallowed diagnostics: wrk's output lived in a command substitution that died with the script on failure; the error message never reached the log. wrk output is now printed on non-zero exit.
3. Unwinnable error budget: with a real Connection: close, the server's close-after-response is the mechanism under test and wrk reports it as one Socket errors: read per request (~2.1M per 60s slice locally). The churn slice now excludes the read component (connect/write/timeout and non-2xx still fail the slice); keep-alive slices keep the full accounting.

Verified locally end-to-end: DURATION=300 run interleaves both slice types and passes (RSS +8.5%, fds +0, errors 0, p99 drift 15.6%).