feat(benchmark): add SkillSpector benchmark harness

[will-exaforce]

Summary

• Add benchmark/, a standalone uv project that runs SkillSpector over a labeled corpus and scores its classifications
• Persist per-unit scan results to DuckDB and ship 14 SQL queries for metrics (recall, false positives/negatives, threshold sweeps, scan timing, per-category/vector breakdowns)
• MalSkillBench dataset handler with parallel scan workers, per-worker auth handling, and per-unit timeouts

Details

Standalone project with an editable dependency on skillspector; root files stay at upstream parity. Worker timeouts use setitimer so sub-second --timeout values arm correctly, and --overwrite clears the sibling .wal to avoid replaying stale state into a fresh DB.