ci: move bench to scheduled workflow + add Python 3.13 (R10, R11)

R10 — `cross-library-bench` previously ran on every push and every PR
to `main`, adding 5–10 minutes of build + bench time per CI run with
no automated consumer of the artefact. It moves to a dedicated
workflow (`.github/workflows/bench.yml`) that fires nightly at 03:00
UTC and on-demand via `workflow_dispatch` (with optional `size` /
`iterations` inputs). The job in `ci.yml` is removed and a pointer
comment is left in its place so future readers find the new home.

R11 — `pyproject.toml`'s `requires-python = ">=3.9"` already allowed
Python 3.13 installs, but the classifier list stopped at 3.12 and CI
tested only 3.9 / 3.11 / 3.12. The Python CI matrix gains `"3.13"`
and the matching `Programming Language :: Python :: 3.13` classifier
is added so PyPI listings and version-search tooling reflect the
actually-tested range.

.github/workflows/bench.yml

@@ -0,0 +1,70 @@
+name: Cross-library benchmark
+
+# Audit finding R10: previously the cross-library benchmark ran on every push
+# and every pull-request to `main`, adding 5–10 minutes of build + bench time
+# per CI run with no consumer of the resulting artefact. The benchmark is now
+# scheduled (nightly at 03:00 UTC) and on-demand via `workflow_dispatch`. The
+# CI pipeline proper (.github/workflows/ci.yml) still verifies build / tests /
+# lints on every push and pull-request.
+on:
+  schedule:
+    # Nightly at 03:00 UTC. Pick a slot well away from common European /
+    # American working-hours pushes to keep this off the critical path.
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+    inputs:
+      size:
+        description: "Number of bars per indicator (default 20000)"
+        required: false
+        default: "20000"
+      iterations:
+        description: "Batch iterations per indicator (default 10)"
+        required: false
+        default: "10"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  cross-library-bench:
+    name: Cross-library benchmark report
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.11"
+
+      - name: Install Python deps + peer libs
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install maturin numpy pandas talipp finta
+
+      - name: Build Wickra wheel
+        working-directory: bindings/python
+        run: maturin build --release --out dist
+
+      - name: Install Wickra wheel
+        working-directory: bindings/python
+        run: python -m pip install --find-links dist --force-reinstall wickra
+
+      - name: Run cross-library benchmark
+        working-directory: bindings/python
+        run: |
+          python -m benchmarks.compare_libraries \
+            --size ${{ github.event.inputs.size || '20000' }} \
+            --iterations ${{ github.event.inputs.iterations || '10' }} \
+            --streaming-window 5000 --streaming-iterations 2 \
+            | tee benchmark.txt
+
+      - name: Upload report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: cross-library-bench
+          path: bindings/python/benchmark.txt

.github/workflows/ci.yml

@@ -185,7 +185,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ["3.9", "3.11", "3.12"]
+        python-version: ["3.9", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
@@ -285,44 +285,7 @@ jobs:
         working-directory: bindings/node
         run: node --test __tests__/
 
-  cross-library-bench:
-    name: Cross-library benchmark report
-    runs-on: ubuntu-latest
-    needs: [python]
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27
-
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.11"
-
-      - name: Install Python deps + peer libs
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install maturin numpy pandas talipp finta
-
-      - name: Build Wickra wheel
-        working-directory: bindings/python
-        run: maturin build --release --out dist
-
-      - name: Install Wickra wheel
-        working-directory: bindings/python
-        run: python -m pip install --find-links dist --force-reinstall wickra
-
-      - name: Run cross-library benchmark
-        working-directory: bindings/python
-        run: |
-          python -m benchmarks.compare_libraries --size 20000 --iterations 10 \
-            --streaming-window 5000 --streaming-iterations 2 \
-            | tee benchmark.txt
-
-      - name: Upload report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: cross-library-bench
-          path: bindings/python/benchmark.txt
+  # The cross-library benchmark has moved to a dedicated scheduled workflow
+  # (.github/workflows/bench.yml) — see audit finding R10. It runs nightly
+  # at 03:00 UTC and on-demand via `workflow_dispatch`, and is no longer on
+  # the every-push / every-PR critical path.