The performance budget audit matches source patterns, so a timer behind a helper or a self-rescheduling callback gets past it

## What happens

`Scripts/perf_budget_audit.py` (added in #438, run by `make verify`) finds repeating work with regular expressions in `repeating_sites` (lines 276-316): `Timer(... repeats: true)`, `Timer.publish`, `.schedule(repeating:)`, display links, and `sleep` or `pause` calls inside a `while`, `repeat` or `for` body. It does not see:

- a repeating timer created inside a helper function whose call site looks like an ordinary call;
- a callback that schedules itself again, for example a `DispatchQueue.main.asyncAfter` or a `Task` that calls the function it is in;
- a sleep in a loop whose body is in another function.

`Docs/performance.md` ("How the budget is enforced", around line 280) describes the audit as reading the source for the ways a budget has been broken before, which is accurate; it cannot see new ways.

## Why it matters

A wake-up the audit misses is a battery cost that ships with a green check.

## How to check

Add a Swift file under a temporary copy of `Sources/` with `func tick() { DispatchQueue.main.asyncAfter(deadline: .now() + 1) { tick() } }` and run the audit: it passes.

## Acceptance criteria

- The audit recognises a function that schedules itself (`asyncAfter`, `Task.sleep` followed by a call to the enclosing function, `perform(_:afterDelay:)`), and a repeating timer created in a function other than its caller, or the limitation is stated in the script's help and in `Docs/performance.md`.
- Each new rule has a case in the script's `--self-test` (run by `make verify`) that fails without it.
- A runtime check is considered as a complement: counting wake-ups of an idle app over a fixed period (for example with `powermetrics` in `make perf-budget-models`), since only a measurement can catch every shape.

Start with Scripts/perf_budget_audit.py, especially repeating_sites around lines 276-316 and its --self-test, then read Docs/performance.md around “How the budget is enforced.” Reproduce the asyncAfter self-scheduling example in a temporary Sources copy and run the audit. Done means the specified missed patterns are detected or the limitation is documented, with regression cases passing through make verify; review the runtime-check suggestion separately.

Written by the indexing model from the issue text.