v1.7.5 — Blazing first connect: cold-cache fix, cert pre-warm, public benchmark

The first impression scenario ("open sberbank.ru") no longer races a
cold cache: Janus now keeps the warm path warm and measures itself.

FIXES
- InMemoryCertCache used try_read/try_write: under contention a read
  returned a false miss and an insert silently dropped its entry.
  Browsers fire several parallel CONNECTs at a new domain, so the cache
  stayed cold and certificates regenerated on every attempt. The map
  now uses blocking locks; a regression test hammers the cache with
  concurrent readers while inserting and demands the entry survives.
- Literal whitelist domains are pre-warmed at startup and on every hot
  reload (src/proxy/prewarm.rs) — certificate generation is off the
  browser critical path. Wildcard patterns cannot be pre-warmed: the
  leaf must match the SNI the browser actually sends.
- Debug eprintln noise removed from the MITM path (Noiseless principle).
- An upstream-first reorder was reverted after the integration suite
  rejected it: an untrusted upstream now fails INSIDE the client HTTPS
  session instead of resetting the browser TLS handshake.

BENCHMARKS (public, speed only — output carries no machine data)
- tests/perf/bench_perf_test.rs: cold vs warm tunnel latency and warm
  worst case through the real proxy core against mock TLS upstreams.
- scripts/bench.sh: debug binary by default, --release to switch,
  --build, --rounds N, --json for robots, --baseline to refresh the
  committed baseline; --quiet for clean stdout.
- Baseline (debug, 20 rounds): cold CONNECT 110ms, warm average 29ms,
  warm worst 32ms — committed as reports/perf/baseline.json so future
  changes compare against numbers, not vibes.