Add protected APIMART benchmark workflow

[luyx-66]

What changed

• add a manual APIMART credential and smoke-benchmark workflow
• default to a no-cost authentication and model-catalog check
• require an explicit boolean input before any image-generation request
• limit generation to one selected model and one fixture, then upload unreviewed artifacts without committing claims
• upgrade official checkout/setup-node actions to Node.js 24 majors

Security and cost controls

• the credential is read only from the APIMART_API_KEY repository secret
• the secret is never printed or written to the repository
• the default workflow run performs no generation
• benchmark output is temporary and requires human review before publication

Validation

• node --check scripts/verify-apimart-credentials.mjs
• node --check scripts/run-smoke-benchmark.mjs
• npm test
• secret-pattern scan: no repository matches