v1.108.163 — License-key transport hardening + benchmark integrity

Closes the last two P2 items of the Excellence Audit.

Security (WS-8): the license key no longer rides a URL query string anywhere — license validation POSTs it in the request body, and starter-pack downloads carry it in the X-JCM-License header, so the key can't land in server/proxy access logs. A narrowly-keyed one-shot legacy fallback protects customers during the backend transition. Also fixed: install-pack reported every license/pack error as a network failure.

Benchmarks (WS-7): benchmarks/results.md regenerated at this version against same-day re-indexes of express / fastapi / gin — 99.6% aggregate token reduction (5,799,695 baseline tokens → 25,220; per-query 99.1–99.9%). The README headline now quotes the same figure as the benchmarks and methodology docs (its old 95% table came from a stale capped index). The harness's dead baseline fallback is fixed, and a token baseline for this release is committed so analyze_perf(compare_release=) resolves.

Full details in CHANGELOG.md.