[AZ-492] Cycle 3 batch 4: perf harness PT-07 + PT-08 + JWT-attach

Drains all three deferred perf-harness items in one batch:
- PT-01..PT-06 now carry Authorization: Bearer minted via the canonical
  SatelliteProvider.TestSupport.JwtTokenFactory (AZ-491) — no third copy
  of JWT logic in the shell.
- PT-07 implemented as cold + warm dual-pass distribution (N=20 each),
  reports p50/p95 for both passes and fails if warm p95 >= cold p95.
- PT-08 implemented as 20-batch upload distribution with batch p95 gated
  at the AZ-488 2000 ms target; per-item gate cost reported as derived
  proxy (batch_p95 / batch_size).

New SatelliteProvider.IntegrationTests/PerfBootstrap.cs adds two CLI
short-circuit subcommands (--mint-only and --gen-uav-fixture <path>)
invoked by the shell so the perf script never inlines the JWT or
JPEG-fixture logic. The dispatch sits at the top of Program.cs Main
and runs before any HTTP / DB / readiness setup.

performance-tests.md PT-07 + PT-08 flip from Deferred to Implemented.
traceability-matrix.md PT-07 + PT-08 rows move from recorded to covered
(PT-08 partial due to per-item proxy — flagged Low in batch-4 review).
_docs/_process_leftovers/2026-05-11_perf-pt07-harness.md deleted; the
leftovers directory is now empty.

Closes cycle-2 retro Action 2; LESSONS.md [process] rule about Deferred
NFRs remains in force as a guardrail.

Also includes the previously-uncommitted cumulative review report for
cycle-3 batches 01-03 (generated at the end of batch 3 but not staged).

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.IntegrationTests/PerfBootstrap.cs

@@ -0,0 +1,91 @@
+using System.Security.Claims;
+using SatelliteProvider.TestSupport;
+using SixLabors.ImageSharp;
+using SixLabors.ImageSharp.Formats.Jpeg;
+using SixLabors.ImageSharp.PixelFormats;
+
+namespace SatelliteProvider.IntegrationTests;
+
+// AZ-492: bootstrap helpers invoked by scripts/run-performance-tests.sh.
+// Each helper is a short-circuit subcommand that prints/writes its output
+// and exits before the integration-test runner does any HTTP or DB work.
+// All token-minting goes through the canonical JwtTokenFactory (AZ-491)
+// so the shell script does NOT inline a third copy of the JWT logic.
+internal static class PerfBootstrap
+{
+    public const string PerfSubject = "perf-tests";
+    public const string GpsPermission = "GPS";
+    public const string PermissionsClaimType = "permissions";
+    public static readonly TimeSpan PerfTokenLifetime = TimeSpan.FromHours(4);
+
+    public static int MintToken()
+    {
+        string secret;
+        try
+        {
+            secret = JwtTestHelpers.ResolveSecretOrThrow();
+        }
+        catch (InvalidOperationException ex)
+        {
+            Console.Error.WriteLine($"--mint-only: {ex.Message}");
+            return 1;
+        }
+
+        var token = JwtTokenFactory.Create(
+            secret,
+            PerfSubject,
+            PerfTokenLifetime,
+            new[] { new Claim(PermissionsClaimType, GpsPermission) });
+
+        Console.Out.Write(token);
+        return 0;
+    }
+
+    public static int GenerateUavFixture(string[] args)
+    {
+        if (args.Length < 2 || string.IsNullOrWhiteSpace(args[1]))
+        {
+            Console.Error.WriteLine("--gen-uav-fixture: missing output path. Usage: --gen-uav-fixture <path>");
+            return 2;
+        }
+
+        var path = args[1];
+        var directory = Path.GetDirectoryName(Path.GetFullPath(path));
+        if (!string.IsNullOrEmpty(directory))
+        {
+            Directory.CreateDirectory(directory);
+        }
+
+        var bytes = CreateValidJpeg();
+        File.WriteAllBytes(path, bytes);
+        Console.Out.WriteLine(path);
+        return 0;
+    }
+
+    // Mirrors the random-noise JPEG produced by UavUploadTests.CreateValidJpeg so
+    // that the perf harness exercises the same quality-gate path as the integration
+    // tests. Pixel pattern is high-variance enough to pass the UAV quality gate.
+    private static byte[] CreateValidJpeg(int width = 256, int height = 256, int seed = 42)
+    {
+        using var image = new Image<Rgba32>(width, height);
+        var random = new Random(seed);
+        image.ProcessPixelRows(accessor =>
+        {
+            for (var y = 0; y < accessor.Height; y++)
+            {
+                var row = accessor.GetRowSpan(y);
+                for (var x = 0; x < row.Length; x++)
+                {
+                    row[x] = new Rgba32(
+                        (byte)random.Next(256),
+                        (byte)random.Next(256),
+                        (byte)random.Next(256));
+                }
+            }
+        });
+
+        using var stream = new MemoryStream();
+        image.Save(stream, new JpegEncoder { Quality = 95 });
+        return stream.ToArray();
+    }
+}

SatelliteProvider.IntegrationTests/Program.cs

@@ -6,6 +6,21 @@ class Program
 {
     static async Task<int> Main(string[] args)
     {
+        // AZ-492: perf-harness bootstrap subcommands short-circuit before any
+        // HTTP / DB setup so they can be invoked from scripts/run-performance-tests.sh
+        // on a host that only has the .NET SDK installed.
+        if (args.Length > 0)
+        {
+            if (args[0].Equals("--mint-only", StringComparison.OrdinalIgnoreCase))
+            {
+                return PerfBootstrap.MintToken();
+            }
+            if (args[0].Equals("--gen-uav-fixture", StringComparison.OrdinalIgnoreCase))
+            {
+                return PerfBootstrap.GenerateUavFixture(args);
+            }
+        }
+
         var apiUrl = Environment.GetEnvironmentVariable("API_URL") ?? "http://api:8080";
         var modeEnv = Environment.GetEnvironmentVariable("INTEGRATION_TESTS_MODE")?.Trim().ToLowerInvariant();
         var modeArg = args.FirstOrDefault(a => a.Equals("--smoke", StringComparison.OrdinalIgnoreCase) || a.Equals("--full", StringComparison.OrdinalIgnoreCase));