[ndr-ds]

Motivation

Two ledger perf tests asserted wall-clock ceilings (< 200 ms for 9 cached queries, < 500 ms for a 50k-row eviction). A millisecond ceiling can't be calibrated once and stay meaningful:

• through the agent sandbox's bind mount both fail 100% of the time, so cargo test in a sandbox is permanently red and teaches you to ignore failures — which is how the genuinely broken main of fix: unbreak main — six foreign_sessions_from test call sites lost an argument in a merge #49 nearly got waved through;
• on a fast disk they're loose enough to pass while the thing they guard regresses.

Change

Both now assert the invariant they were written for, measured against a control on the same machine, so the number is portable:

• perf_summarize_cached_stays_fast_with_many_rows → perf_summarize_cached_costs_far_less_than_parsing. Times one refresh_cache_from of the same 50k rows as the baseline, then requires 9 cached queries to cost less than half of it. The regression it guards (commit 0d6e2d3a, where every call linear-scanned the CSV) made each of the nine cost a whole parse, so the two can never be confused.
• perf_eviction_stays_linear_with_many_rows keeps its name and now compares 25k rows against 50k on the same machine: linear doubles, quadratic quadruples, so a 3× ceiling separates them with room for scheduler noise.

seed_cache_with_synthetic_rows becomes write_synthetic_ledger(&Path, n), keeping the 30-day row spread so the day/week/month cutoffs still match distinct subsets. It takes the path rather than returning one because TestPaths deletes its tree on Drop — a helper owning the guard and handing back a PathBuf would return a path to a deleted directory, and a timing ratio over a missing ledger passes vacuously. That trap is now called out in the helper's doc comment.

Not in this PR

app::tests::perf_do_refresh_io_does_not_explode_with_repeated_calls gets the same treatment, but converting it to a cold-vs-warm ratio fails on real data — warm ticks cost about as much as the cold one (22.8 s vs 32.0 s in a sandbox; the host's 10.37 s for three calls implies the same flat shape). That is a real finding, not a test-calibration problem, so the rewritten test belongs in the same PR as its fix rather than landing red here. Filed separately.

Verification

$ cargo fmt --all -- --check                      # clean
$ cargo clippy --all-targets -- -D warnings       # clean
$ cargo test --lib usage_ledger::tests::perf      # 2 passed, in 1.88 s

Both pass inside the sandbox, where the versions they replace fail — which is the whole point.