[heft-native] Round 4: SIMD + SHA-NI + syscall squeeze (experiment)

[Sean Larkin (TheLarkInn)]

Squeeze the Rust heft to the metal. Assembly-class optimizations, same output.

Stacked on #6098, so this diff is the Round-4 work only (apps/heft-native). Full diff vs main: main...thelarkinn/heft-native-rust-r4

The honest ceiling

A no-libc write()+exit() binary takes ~0.4-0.58 ms here: the kernel's floor for any process. heft --help is ~2 ms, so 10x on startup wall time (0.2 ms) is below the floor and impossible. This PR chases the floor and puts the real 10x-class wins where the work actually is.

Highest wins

What	Speedup	Where
JSON byte-scan, 4 KB run	up to 26x	SIMD vs its scalar twin
JSON byte-scan, CJK text	10.3x	SIMD vs scalar
64 MiB asset, up-to-date build	6.1x	SHA-NI + syscalls, vs Rust base
10k-file --clean	3.9x	forked workers, vs Rust base
Tier 0 (--help/--version/native build)	1.40-1.55x	syscall cuts + static link, vs Rust base
heft --help vs heft 1.3.1	203x (408 -> 2.0 ms)	whole effort

What changed (apps/heft-native only)

• SIMD (src/simd): SSE2/AVX2 JSON byte-scans behind runtime is_x86_feature_detected!, with a scalar fallback and a HEFT_NATIVE_SIMD=0 kill switch. Portable intrinsics, no raw asm.
• SHA-NI file hashing and forked workers for large trees (src/builtin).
• Syscall cuts on the Tier 0 resolution path: --help 211 -> 158 syscalls, stat-like 83 -> 54.
• Static glibc link + own C main.

Safety and compatibility

• Output and exit codes byte-identical to heft 1.3.1 and to the Rust base, SIMD on and off.
• unsafe only in src/sys and src/simd; std only, no crates, no Node bindings.
• ~285M SIMD-vs-scalar fuzz cases, 0 mismatches; ASAN/valgrind/QEMU clean; aarch64/windows/macOS build.
• Peak RSS -48..-50% vs the Rust base; binary 1.54 MB.

Limits

• Node-plugin build tiers are unchanged (Node startup dominates).
• Static binary is slightly slower on a cold first run after install (larger on disk); kept as default because warm wins dominate. Dynamic fallback: RUSTFLAGS="-C target-feature=-crt-static".
• Linux x64 measured. Experiment for comparison; no Rush change files yet.