[matmen]

Adds bench/, a benchmark comparing ImageScript with ImageScript 1, Jimp, image-js, Photon, sharp and @napi-rs/canvas. It measures:

• decoding and encoding
• image operations
• text and SVG rendering
• animated GIFs
• encoded file sizes
• install sizes

The results, with charts, go to bench/README.md, and the main README links to them.

• run.js runs every library in its own process (bench.js). @napi-rs/canvas frees native memory only in finalizers, so for that library the run calls gc() and yields to the event loop between iterations. Without this, its memory grew by several GB. Skia draws lazily, so a single-pixel getImageData forces it to actually render; otherwise its numbers are fake.
• installs.js runs npm install for each library in an empty project and measures node_modules and the number of packages actually installed.
• report.js draws the charts and writes the README.
• Inputs come from Wikimedia Commons (CC BY 2.0, CC0, public domain). Sources and licenses are in bench/inputs/SOURCES.md.
• Dependency versions are pinned exactly in bench/package.json. IMAGESCRIPT=local benchmarks dist/ instead of the npm package.

CI: release.yml has a new bench job for regular releases (dist-tag latest). It calls bench.yml, which installs the version that was just published, runs everything and commits the results to master. bench.yml can also be run by hand with a version.

Notes:

• The committed results come from a noisy LXC (±10–20%). Running bench.yml once after merging replaces them with runner numbers.
• If master gets branch protection, the job's push needs a bypass.