milestone 14: build, package, sign and publish releases

docs/reference/performance.md

@@ -13,11 +13,17 @@ see [measure performance](../how-to/measure-performance.md).
 | Blocklist lookup p95 < 1 ms | `bench filter`: `matcher.normalize` + `Snapshot.evaluate` per op |
 | Cached response p95 < 5 ms | `bench cache`: `buildKey` + `DnsCache.get` + `packet.setId` per op |
 | Memory with ~1M blocked domains < 100 MiB | `bench filter`: VmRSS with the 1M-domain snapshot loaded |
-| Stripped static binary < 10 MiB per arch (< 15 MiB with the embedded frontend) | CI size assert on the `cross` artifacts |
+| Stripped static binary ≤ 10,485,760 bytes per arch without the embedded frontend, ≤ 15,728,640 bytes with it | `zig build verify-dist`, run by the `package` gate and by the release |
 
 The harness is `tools/bench.zig`. It measures the three targets that are
 measurable in process; the qps target is end to end and the binary-size target
-belongs to CI.
+belongs to the packaging step.
+
+The two size budgets are exact byte counts, not rounded mebibytes, because an
+assert on a rounded number is an assert on a number nobody wrote down.
+`verify-dist` checks the shipped binary against the larger budget and builds a
+second time against a generated empty assets directory for the smaller one, so
+the asset-free figure is a real measurement rather than an estimate.
 
 ## Measured: x86_64 development host