fix(swarm-test): give the benchmark its become password, and no veto

Run 37931817959 timed the four cells and two of them are real: a module
call costs 245ms over docker and 212ms over ssh through the tunnel, with or
without become on the docker side. The connection plugin is not the cost.

The escalated ssh cell is not real. The benchmark ran without the extras, so
ansible_become_password was absent and all 200 calls failed on 'Incorrect sudo
password' - 3.2s each, which prices a failing sudo rather than a working one.
It now passes the same two -e files the deploy passes.

Its exit code also reached the round, so a diagnostic turned three green
deploys red. transport_bench now discards its own rc: whether a deploy passes
is not a benchmark's business.

utils/tests/swarm/matrix.py

@@ -255,7 +255,13 @@ def _verify_recovered_marker(*, app_id: str) -> int:
     )
 
 
-def _mesh_prologue(*, app_id: str, inv_dir: str, round_variants: dict[str, int]) -> int:
+def _mesh_prologue(
+    *,
+    app_id: str,
+    inv_dir: str,
+    extras_path: str,
+    round_variants: dict[str, int],
+) -> int:
     """Put every node and the controller on the mesh, then move the transport.
 
     The credential reset runs here rather than between the passes, where the
@@ -266,6 +272,7 @@ def _mesh_prologue(*, app_id: str, inv_dir: str, round_variants: dict[str, int])
     Args:
         app_id: primary application of the round.
         inv_dir: inventory directory of the round.
+        extras_path: round extras, for the optional transport benchmark.
         round_variants: the round's ``{app_id: variant_index}`` map.
     """
     rc = bootstrap_mesh(inv_dir=inv_dir)
@@ -280,11 +287,15 @@ def _mesh_prologue(*, app_id: str, inv_dir: str, round_variants: dict[str, int])
     if rc == 0:
         rc = mesh_controller(inv_dir=inv_dir)
     if rc == 0:
-        rc = transport_bench(inv_dir=inv_dir, label="docker")
+        rc = transport_bench(
+            inv_dir=inv_dir, extras_path=extras_path, label="docker"
+        )
     if rc == 0:
         rc = switch_to_mesh_transport(inv_dir=inv_dir)
     if rc == 0:
-        rc = transport_bench(inv_dir=inv_dir, label="ssh over the mesh")
+        rc = transport_bench(
+            inv_dir=inv_dir, extras_path=extras_path, label="ssh over the mesh"
+        )
     return rc
 
 
@@ -441,7 +452,10 @@ def main(argv: list[str] | None = None) -> int:
         )
         if rc == 0 and meshed:
             rc = _mesh_prologue(
-                app_id=app_id, inv_dir=inv_root, round_variants=round_variants
+                app_id=app_id,
+                inv_dir=inv_root,
+                extras_path=deploy_extras,
+                round_variants=round_variants,
             )
         if rc == 0:
             rc = _deploy(**deploy_args)

utils/tests/swarm/mesh.py

@@ -14,6 +14,7 @@ _MESH_NAME = "swarm"
 _CONTROLLER = "localhost"
 _PLAYBOOK = "playbook-mesh.yml"
 _BENCH_PLAYBOOK = "transport-bench.yml"
+_SWARM_EXTRAS_VARS = "inventories/development/swarm.yml"
 _DEFAULT_ADMIN_KEY = "/tmp/swarm-nfs-admin.key"  # noqa: S108 - ephemeral swarm-test path, overridable via KEY_PATH
 
 _LAB_ADDRESSES = {
@@ -130,32 +131,40 @@ def mesh_controller(*, inv_dir: str) -> int:
     )
 
 
-def transport_bench(*, inv_dir: str, label: str) -> int:
+def transport_bench(*, inv_dir: str, extras_path: str, label: str) -> int:
     """Time a fixed number of module calls over whatever transport is in force.
 
     Run once before the transport switch and once after, the four task
     durations decompose the meshed arm's per-task cost into the connection
-    plugin and the privilege escalation. Off unless asked for: it is a
-    diagnostic, not part of what a round proves.
+    plugin and the privilege escalation. Off unless asked for, and its exit
+    code never reaches the round: a diagnostic must not decide whether a
+    deploy passes.
 
     Args:
         inv_dir: inventory directory of the round.
+        extras_path: round extras, which carry the become password the
+            escalated half of the benchmark needs.
         label: which transport the numbers belong to, for the banner.
     """
     if (os.environ.get("INFINITO_SWARM_TRANSPORT_BENCH") or "").strip().lower() != "true":
         return 0
-    return run_step(
+    run_step(
         [
             "ansible-playbook",
             "-i",
             f"{inv_dir}/devices.yml",
             "--vault-password-file",
             f"{inv_dir}/.password",
+            "-e",
+            f"@{_SWARM_EXTRAS_VARS}",
+            "-e",
+            f"@{extras_path}",
             _BENCH_PLAYBOOK,
         ],
         env=os.environ.copy(),
         label=f"transport benchmark ({label})",
     )
+    return 0
 
 
 def switch_to_mesh_transport(*, inv_dir: str) -> int: