Add cube-bench (correctness-gated microbenchmarks) + daemon stats telemetry

- cube-bench crate: real-code-path throughput/latency over cubestore,
  cubecrypt (aes/gcm/chacha/xts), cubecode VM, and cubesys Session.
  Every section asserts correctness before timing. Wired into ./check
  as an opt-in 'bench' stage.
- cubesys Session: per-command latency histogram + per-C-namespace record
  counts, exposed via a new 'stats' command over the live socket.
- Deployed rebuilt cube-server to /home/luulu/.cubelinux/bin and
  restarted the system cube.service; verified stats live.

check

@@ -4,6 +4,7 @@
 #   ./check          full gate (fmt, tests, clippy -D warnings)
 #   ./check quick    tests only
 #   ./check mount    full gate + live FUSE mount end-to-end (needs root)
+#   ./check bench    full gate + cube-bench correctness-gated microbenchmarks
 #
 # Exit 0 means the tree on disk is green. This is the single source of truth;
 # do not claim verification from an ad-hoc run.
@@ -12,6 +13,9 @@
 # it is the only stage that exercises the real kernel VFS path. Two Package 3
 # defects (mkdir -p to depth 4, cross-user ACLs) passed every unit test and
 # were caught only here — so run it before calling filesystem work done.
+# Why `bench` is opt-in: it is a release build + timed run of cube-bench, which
+# is slow and machine-noise-sensitive; it asserts correctness on every path but
+# the numbers are informational, not a pass/fail gate.
 set -euo pipefail
 cd "$(dirname "$0")"
 
@@ -37,7 +41,16 @@ cargo test --workspace $FEAT --jobs "$JOBS"
 step "3/3  clippy"
 cargo clippy --workspace --all-targets $FEAT --jobs "$JOBS" -- -D warnings
 
-[ "${1:-}" = mount ] || { printf '\n\033[32mALL CHECKS PASSED\033[0m  (run ./check mount for live FUSE e2e)\n'; exit 0; }
+[ "${1:-}" = mount ] || { printf '\n\033[32mALL CHECKS PASSED\033[0m  (run ./check mount for live FUSE e2e, ./check bench for metrics)\n'; exit 0; }
+
+[ "${1:-}" = bench ] || { printf '\n\033[32mALL CHECKS PASSED\033[0m  (run ./check mount for live FUSE e2e, ./check bench for metrics)\n'; exit 0; }
+
+step "4/4  cube-bench"
+# Release build + timed run. Asserts correctness on every path; numbers are
+# informational. JOBS kept modest so we don't saturate the box.
+cargo run -p cube-bench --release --jobs "$JOBS"
+printf '\n\033[32mALL CHECKS PASSED\033[0m (incl. cube-bench)\n'
+exit 0
 
 step "4/4  live FUSE mount"
 [ "$(id -u)" -eq 0 ] || { echo "SKIP: live mount needs root" >&2; exit 1; }