[codex] Restore sidecar reuse fast paths

[NathanFlurry]

Summary

• Adds Sidecar as the public reusable sidecar process object and wires NodeRuntime.create({ sidecar }) through VM boot.
• Keeps omitted sidecar on the default shared sidecar/session behavior.
• Prevents NodeRuntime.dispose() from disposing caller-owned sidecar processes.
• Adds boot timing hooks plus a resident Node runner for the repeated tiny-exec fast path.
• Restores the cold-start scenario benchmark matrix and documents how to run it in packages/benchmarks/README.md.
• Updates wrapper exports, the native-client example, benchmark result artifacts, and the Rust transport comment to match the new naming.

Root Cause

The 0.3 path was paying full sidecar/session/VM/runtime/process startup cost in places that should reuse an already-running sidecar and guest Node process. The public API also exposed the wrong mental model: users should pass an object reference, not a wire sidecar_id.

Benchmarks

The checked-in benchmark artifacts are under packages/benchmarks/results/:

• coldstart-final.json
• coldstart-final.log
• coldstart-resident-full-matrix-20260619.json
• coldstart-resident-full-matrix-20260619.log

The reproducible SDK scenarios are documented in packages/benchmarks/README.md and runnable with pnpm --dir packages/benchmarks bench after building a release sidecar.

Validation

• pnpm --dir packages/core check-types
• pnpm --dir packages/secure-exec check-types
• pnpm --dir packages/benchmarks exec tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 --types node coldstart.bench.ts bench-utils.ts
• Smoke benchmark: BENCH_BATCH_SIZES=1 BENCH_ITERATIONS=1 BENCH_WARMUP=0 BENCH_SCENARIOS=owned-sidecar,shared-sidecar,resident-runner ... pnpm --silent --dir packages/benchmarks bench:coldstart
• CARGO_TARGET_DIR=/home/nathan/secure-exec-perf-restore/target cargo check -p secure-exec-client

[railway-app]

🚅 Environment secure-exec-pr-98 in rivet-frontend has no services deployed.