Add a feature-gated profiler for the rx-loop maintenance tick

The tick arm runs twenty-six housekeeping steps in sequence on the one
runtime thread, and is polled last, so anything slow in it holds up
inbound packets, TUN traffic and control commands behind it. Field
evidence says that happens for over a second at a time, but the
attribution behind that is two months old and predates the
connect-on-send gate, the control read isolation, and the peer lifecycle
rework. This measures it rather than continuing to reason about it.

Per step it records exact count, max and total into fixed static
counters; a dedicated writer thread drains them every ten seconds to a
TSV under /var/log/fips, one file per capture, capped at 32 MB. Nothing
accumulates: the counters are swapped to zero each interval and the
thread holds no history. Arming is `fipsctl profile tick on`, served in
the control accept task so the toggle cannot queue behind the very
behaviour it measures, and it does not survive a restart.

The whole thing is behind a Cargo feature that is off by default,
because the risk worth eliminating is the twenty-six edited call sites
in the hot loop. With the feature off the macro expands to the bare
expression, which makes the default build's neutrality something you
read off the generated code rather than something a benchmark fails to
disprove.

The measurement that matters is how late each tick is against the
deadline it was scheduled for, since the arm is polled last and that
lateness is the delay. Two earlier designs derived it from the interval
between entries and both under-reported: the schedule is fixed, so a
steady delay leaves every gap exactly one period and any gap-derived
figure reads zero under precisely the sustained overload this is meant
to find. The interval hands back its own deadline, so the delay is now a
subtraction with no model behind it, and a test drives three late ticks
at a constant gap to keep it that way.

CI gains a default-features clippy and a feature-on build and test on
both runners, closing the gap left by clippy already running with all
features.

.github/workflows/ci.yml

@@ -110,6 +110,17 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-
       - run: cargo clippy --all-targets --all-features -- -D warnings
+      # An optional feature means two source trees, and --all-features lints
+      # only one of them. The default build is what ships, so lint it
+      # explicitly: without this stage, code that compiles only with
+      # `profiling` enabled would pass CI while breaking every release build.
+      # Mirrored in testing/ci-local.sh — check-ci-parity.sh compares
+      # integration suites only and will not catch a stage added to one runner
+      # and not the other.
+      - name: Clippy (default features)
+        run: cargo clippy --all-targets -- -D warnings
+      - name: Build with the tick-body profiler enabled
+        run: cargo build --workspace --features profiling
 
   # ───────────────────────────────────────────────────────────────────────────
   # Android cross-check
@@ -293,6 +304,12 @@ jobs:
           check_name: Unit Tests Summary
           fail_on_failure: false
 
+      # The `profiling` feature adds a module, a recorder and a writer thread
+      # that the default-feature run above never compiles, so its own tests do
+      # not execute there. Mirrored in testing/ci-local.sh.
+      - name: Run library tests with the tick-body profiler enabled
+        run: cargo test --lib --features profiling
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Job 2b – Unit tests (macOS)
 # ─────────────────────────────────────────────────────────────────────────────