perf: use --build-local in benchmarks to test source code changes (#1872)

The benchmark previously pulled pre-built GHCR images, meaning changes
to container files (entrypoint.sh, Dockerfiles) had no effect on results
until a new release published updated images. PR #1851's sleep 5 fix
showed zero improvement for this reason.

Changes:
- Add --build-local to AWF_CMD so containers are built from source
- Cold start now clears Docker build cache instead of removing GHCR images
- Include awf-iptables-init in cleanup for completeness

Closes #1869

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Mossaka

scripts/ci/benchmark-performance.ts

@@ -21,9 +21,9 @@ import { stats, parseMb, checkRegressions, BenchmarkResult, BenchmarkReport } fr
 // ── Configuration ──────────────────────────────────────────────────
 
 const ITERATIONS = parseInt(process.env.AWF_BENCHMARK_ITERATIONS || '30', 10);
-const AWF_CMD = "sudo awf";
+const AWF_CMD = "sudo awf --build-local";
 const ALLOWED_DOMAIN = "api.github.com";
-const CLEANUP_CMD = "sudo docker compose down -v 2>/dev/null; sudo docker rm -f awf-squid awf-agent 2>/dev/null; sudo docker network prune -f 2>/dev/null";
+const CLEANUP_CMD = "sudo docker compose down -v 2>/dev/null; sudo docker rm -f awf-squid awf-agent awf-iptables-init 2>/dev/null; sudo docker network prune -f 2>/dev/null";
 
 // ── Thresholds (milliseconds or MB) ───────────────────────────────
 
@@ -63,9 +63,9 @@ function benchmarkColdStart(): BenchmarkResult {
 
   for (let i = 0; i < ITERATIONS; i++) {
     cleanup();
-    // Remove cached images to force cold pull
+    // Remove locally-built images and build cache to force a full rebuild
     try {
-      execSync("sudo docker rmi ghcr.io/github/gh-aw-firewall/squid:latest ghcr.io/github/gh-aw-firewall/agent:latest 2>/dev/null", { stdio: "ignore", timeout: 30_000 });
+      execSync("sudo docker image prune -af --filter 'label=com.docker.compose.project' 2>/dev/null; sudo docker builder prune -af 2>/dev/null", { stdio: "ignore", timeout: 60_000 });
     } catch {
       // images may not exist
     }