governance: bench is removed from the model-swap procedure

Model changes verify by driving the live service — boot ledger,
per-request timings, one real request per harness role. No bench window
is ever scheduled for a swap. The stop-and-mask policy stays for
deliberate standalone bench windows (it is host protection, not a swap
step). Codified in AGENTS.md (policy lead + summary row), Model Swap and
Rollback (No bench step law, §8 close-out source, Related rescope).

AGENTS.md

@@ -226,6 +226,13 @@ archive.
 
 ## Benchmarking Policy (MANDATORY)
 
+**Benchmarking is NOT part of the model-swap procedure** (2026-10-15). A
+model change is verified by driving the live service — boot ledger,
+per-request `timings`/`Server-Timing`, one real request per harness role
+(`serverAppConfigs-docs/LLM/Model Swap and Rollback.md` §6/§8). No bench
+window is scheduled for a swap, ever. The rest of this policy governs
+*deliberate* bench windows (flag A/Bs, shape sweeps), which are separate
+operations on a live host:
 **STOP the production service BEFORE benchmarking** — these servers serve
 real users, and a bench beside a live service starves the GPU and corrupts
 results. Use the runtime's own harness: `llama-bench` for the llama.cpp
@@ -1157,7 +1164,7 @@ history.
 | Unstaged local changes | **Commit or discard** — check `git status` before starting work; ask if unsure. |
 | Deploying a committed change | **`scripts/deploy.sh <target>`** — pushes, pulls ff-only, plans, dispatches, health-checks. |
 | Container without a Quadlet unit | **Give it one** — boot-persistent, self-healing `.container` via git. |
-| Benchmarking | **Stop and mask the service first**, bench, unmask, restart, verify health. |
+| Benchmarking | **Not part of a model swap** — swaps verify on the live service. A deliberate bench window: **stop and mask the service first**, bench, unmask, restart, verify health. |
 | Deleting a file | **Move it to trash** — `.AGENTTRASH/` (in-repo) or `~/.AGENTTRASH/YYYYMMDD-topic`. Never `rm`. |
 | Tests exist | **Run them** — verify tests pass after every change. Do not commit failing tests. |
 | Real secrets | **Never commit** — host `.env` files; `.env.example` holds placeholders only. |