ci(benchmarks): gate rendered GFM security regressions

.github/workflows/ci.yml

@@ -264,3 +264,20 @@ jobs:
           ODYSSEUS_TEST_PYTHON=python ODYSSEUS_LAYOUT_BROWSER=chromium npx --no-install playwright test \
             --config tests/e2e/ios-layout.config.cjs \
             --reporter=line
+
+  benchmark-gfm-security:
+    name: Benchmark GFM rendering security
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.11"
+      # Test-only renderer, pinned independently of application requirements.
+      - name: Install GitHub Flavored Markdown renderer
+        run: |
+          python -m pip install --disable-pip-version-check --only-binary=:all: "cmarkgfm==2025.10.22"
+      - name: Verify rendered benchmark report security
+        run: python tests/test_audit_c5_benchmark_evidence.py --gfm