perf(push): drop per-entry cache fsync; let long runs profile themselves

The cache fsynced every payload and manifest -- two per entry, ~18 ms, and a
push publishes one entry per question (~22,000 on a WordPress plugin). A
read already rejects any entry whose manifest receipt, payload size or
payload SHA-256 does not check, so a torn write is a miss, never a wrong
answer; the fsyncs bought nothing the verification does not.

The broader problem: three quadratic walls in this replay were found one
per two-hour run, because all were Python bookkeeping between engine calls
and the only record was the engine log. `OUSAST_SAMPLE_PROFILE=<path>`
starts an in-process sampler that rewrites the hottest stacks every 30 s,
so a run killed at its deadline still names where its time went. The host
cannot ptrace the container, hence in-process. The replay harness turns it
on per case.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/cli.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from time import perf_counter
 from typing import TYPE_CHECKING, Any
 
-from . import tool_hunter
+from . import profiling, tool_hunter
 from .benchmark import (
     create_benchmark_run,
     evaluate_benchmark,
@@ -243,6 +243,7 @@ def main(argv: list[str] | None = None) -> int:
     # indistinguishable from a run with nothing to report, which is how four PHP investigations were
     # spent reading a later stage's timeout as the cause.
     _configure_logging()
+    profiling.start()  # only when OUSAST_SAMPLE_PROFILE names a file
     if args.command == "pre-push":
         from .config import PushConfig
         from .push.runner import push, replay