Add a feature-gated profiler for the rx-loop maintenance tick

The tick arm runs twenty-six housekeeping steps in sequence on the one
runtime thread, and is polled last, so anything slow in it holds up
inbound packets, TUN traffic and control commands behind it. Field
evidence says that happens for over a second at a time, but the
attribution behind that is two months old and predates the
connect-on-send gate, the control read isolation, and the peer lifecycle
rework. This measures it rather than continuing to reason about it.

Per step it records exact count, max and total into fixed static
counters; a dedicated writer thread drains them every ten seconds to a
TSV under /var/log/fips, one file per capture, capped at 32 MB. Nothing
accumulates: the counters are swapped to zero each interval and the
thread holds no history. Arming is `fipsctl profile tick on`, served in
the control accept task so the toggle cannot queue behind the very
behaviour it measures, and it does not survive a restart.

The whole thing is behind a Cargo feature that is off by default,
because the risk worth eliminating is the twenty-six edited call sites
in the hot loop. With the feature off the macro expands to the bare
expression, which makes the default build's neutrality something you
read off the generated code rather than something a benchmark fails to
disprove.

The measurement that matters is how late each tick is against the
deadline it was scheduled for, since the arm is polled last and that
lateness is the delay. Two earlier designs derived it from the interval
between entries and both under-reported: the schedule is fixed, so a
steady delay leaves every gap exactly one period and any gap-derived
figure reads zero under precisely the sustained overload this is meant
to find. The interval hands back its own deadline, so the delay is now a
subtraction with no model behind it, and a test drives three late ticks
at a constant gap to keep it that way.

CI gains a default-features clippy and a feature-on build and test on
both runners, closing the gap left by clippy already running with all
features.

CHANGELOG.md

@@ -9,6 +9,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- An optional tick-body profiler behind the new `profiling` Cargo feature,
+  **off by default**. When enabled, `fipsctl profile tick on [--dir PATH]` /
+  `off` / `status` starts and stops a capture at runtime with no restart. Each
+  capture writes one tab-separated file (default `/var/log/fips`, capped at
+  32 MB) carrying, per ten-second interval, the exact count, max and total for
+  every step of the rx-loop tick arm, the whole-tick span, and gauges for ticks,
+  peer count, the gap between successive tick-arm entries and the resulting
+  arm-starvation delay. With the feature off the instrumentation macro is a pure
+  pass-through, so a default build contains no timing code on the tick path.
+  `LogsDirectory=fips` was added to the packaged systemd units so the capture
+  directory is created and cleaned up declaratively.
+
 ### Changed
 
 - The Ethernet transport's per-interface `discovery` flag was renamed to