Performance

## Overview

While OpenTDFKit meets current functional requirements, several hot paths generate avoidable overhead. This issue captures the prioritized improvements and the acceptance criteria for completing the optimization work.

## Goals

- Reduce unnecessary allocations and actor hops in NanoTDF creation/decryption flows.
- Accelerate key-generation code paths that are currently serialized despite asynchronous scaffolding.
- Minimize redundant HKDF and AES-GCM operations inside the KAS rewrap logic.
- Preserve functional parity and spec compliance while improving throughput.

## Scope

### 1. CryptoHelper Lifetime Management

**Current Pain Point**
- `NanoTDF.getPayloadPlaintext` and `createNanoTDF` instantiate `CryptoHelper()` per call, despite the helper being stateless. Actor creation and cross-actor `await` introduce latency.

**Acceptance Criteria**
- [ ] Replace per-call instantiation with a shared helper (static instance, task-local, or converted struct).
- [ ] Remove the extra `await` hops from CryptoHelper convenience methods.
- [ ] Benchmarks in `NanoTDFBenchmarkTests` show measurable improvement (>10% reduction in per-op runtime on M1 Max reference numbers).

### 2. KeyStore Batch Generation Concurrency

**Current Pain Point**
- `KeyStore.generateAndStoreKeyPairs` uses `withThrowingTaskGroup` but each task immediately awaits `self.generateKeyPair()`, serializing the work.

**Acceptance Criteria**
- [ ] Refactor batch generation so key creation happens outside the actor (e.g., detached tasks returning raw key material before inserting into the actor).
- [ ] Maintain thread-safe insertion of results into `keyPairs`.
- [ ] Update benchmark tests (`KeyStoreBenchmarkTests`) to confirm throughput regression does not occur; document improved ops/sec if observed.

### 3. BinaryParser Zero-Copy Reads

**Current Pain Point**
- `BinaryParser.read` uses `Data.subdata(in:)`, creating a copy on every header field.

**Acceptance Criteria**
- [ ] Switch to slicing with `data[cursor..

Start with `swift test --filter "BenchmarkTests"` to capture baselines, then inspect `NanoTDF.getPayloadPlaintext`, `createNanoTDF`, `KeyStore.generateAndStoreKeyPairs`, `BinaryParser.read`, and `KASService.rewrapKeyInternal`. Use the named benchmark and unit test suites, plus Instruments or signposts, to validate allocation and throughput changes. Done means all listed acceptance criteria pass without functional or spec regressions.

Written by the indexing model from the issue text.