Generalizes the ad-hoc BLITTER_PROFILE pattern into a reusable,
zero-overhead-when-off counter system any subsystem can use.

* src/core/perf_counters.{h,c} - PERF_COUNTER / PERF_INC / PERF_ADD
  macros backed by a constructor-registered linked list.  When
  BENCH_PROFILE is undefined every macro expands to (0) so there is
  no runtime, code-size, or symbol cost in shipped builds.

* src/tom/blitter.c - migrate the existing BLITTER_PROFILE counters
  in BlitterMidsummer2 onto the new system.  Counters are embedded in
  existing initializers via the comma operator so the file stays
  C89-clean (no statements before declarations).

* Makefile - `make BENCH_PROFILE=1` defines the macro globally.
  `make benchmark BENCH_PROFILE=1` re-invokes with TEST_EXPORTS=1 so
  test_benchmark can dlsym `perf_counters_dump` and print all
  registered counters next to the FPS report.

* test/tools/test_benchmark.c - dlsym the optional dump symbol; if
  present (BENCH_PROFILE build), call it before the BENCHMARK RESULTS
  block.  No effect on default builds.

* exports-test.list / link-test.T - add perf_counters_{dump,reset,
  register} so harnesses can reach them under TEST_EXPORTS=1.

* scripts/profile-mac.sh - one-line wrapper around `xctrace record`.
  Defaults to Time Profiler; --template "CPU Counters" for PMU
  events on Apple Silicon.  Builds the core + harness, runs the
  benchmark under instrumentation, writes a .trace bundle, and can
  auto-open it with --open.

* docs/profiling.md - new sections covering BENCH_PROFILE counters
  (when to use vs sampling profilers) and the profile-mac.sh wrapper.

Validated end-to-end with `make benchmark BENCH_PROFILE=1
BENCH_BLITTER=accurate`: counters populate
(blitter_inner=283994 over 120 frames of yarc), and default builds
remain unchanged.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

The +15% inlining win shipped in the previous commit didn't fix the
real-world AvP audio stutter, because audio dropouts are governed
by *worst-case* frame time, not average.  This commit lands the
diagnostic infrastructure that found the actual cost driver.

* test_benchmark now records per-frame timing and reports
  p50 / p99 / p999 / max ms-per-frame plus the count of frames
  that blew the 16.67 ms (60 Hz) budget.

* perf_counters.h gains `perf_counters_find(name)` so the harness
  can snapshot a counter before/after each retro_run() call and
  report per-frame deltas.

* test_benchmark uses the new lookup to print the slowest frames
  along with their blitter call count and inner-iteration count,
  and the slow-vs-avg ratio.

* Makefile gains BLITTER_TRACE=1 toggle that wires
  -DBLITTER_TRACE; src/tom/blitter.c grows a per-blit elapsed-ms
  dump that fires for any single BlitterMidsummer2 call exceeding
  a threshold, so we can tell whether worst-case frame spikes are
  one giant blit or many small ones.

What this revealed for AvP gameplay (state7, accurate blitter,
1200 frames after 120 warmup, M-series host):

   avg 5.1 ms, p99 17.0 ms, p999 18.2 ms, max 18.4 ms
   25 / 1200 frames over 16.67 ms (2%)

   Avg per frame:    403 blits,   49,774 inner iters
   Slow per frame:  2009 blits,  247,508 inner iters  (5x)

The slow frames are perfectly periodic and consistent (5x the work
on every spike, every spike same exact count).  No single blit is
slow -- the BLITTER_TRACE dump prints zero lines even at a 0.3 ms
threshold.  AvP is just doing 5x more blitter work on roughly
every 24th frame.  That's the audio dropout root cause: the inlining
helped average throughput but the periodic 5x spikes still blow
the budget.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

MSVC x86 / x64 compilation checks failed on PR #129 because
`__attribute__((always_inline))` is GCC/Clang-specific.  Wrap it
in a BLITTER_ALWAYS_INLINE macro that maps to:

  GCC / Clang: inline __attribute__((always_inline))
  MSVC:        __forceinline                    (replaces inline)
  Other:       inline                           (best-effort)

The macro spells the inline keyword itself so call sites are just
`static BLITTER_ALWAYS_INLINE void foo(...)` -- no extra INLINE
qualifier (MSVC's __forceinline conflicts with another inline
keyword, which is why the original `static INLINE __attribute__(...)`
form would have failed there even if MSVC understood the attribute).

Verified: clang still inlines (AvP accurate ~196 FPS, same as the
attribute-only form); test suite passes; libretro buildbot's MSVC
target should now build clean.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

Copilot review on PR #129 caught that the per-frame stats path
unconditionally allocates / sorts / divides by num_frames, which
would OOB-access sorted[num_frames - 1] and divide by zero if a
caller passed 0 or a negative number.  Both come from atoi() which
returns 0 on garbage input, so this was reachable.

Validate both at parse time and exit with a clear error before
allocating anything.

Co-Authored-By: Claude Opus 4.7 <[email protected]>