Summary

• make registry-* benchmark runs default to a local toxiproxy-backed network path with a symmetric bandwidth cap, while keeping --network-profile=none as an escape hatch
• route each proxied registry through its own loopback IP on the original upstream port so both metadata and tarball fetches stay inside the isolated path
• expose the profile/rate controls in ./bench, document the behavior, and install/configure toxiproxy in setup and workflow paths so the default registry-bandwidth profile runs at 12000 KB/s in CI and locally

Benchmark Notes

• Docker reproduction on next / registry-clean with npm only (--runs=3 --warmup=1) completed on main at 8.72s ± 0.17s.
• The same benchmark on this branch, under the isolated registry-bandwidth profile, completed at 13.18s ± 0.09s.
• Concise takeaway: the isolated path is slower, but it roughly halves run-to-run noise in this sample (±0.17s -> ±0.09s).

Verification

• bash -n bench
• bash -n scripts/network-isolation.sh
• bash -n scripts/registry/common.sh
• bash -n scripts/setup.sh
• ./bench run --variation=registry-clean --fixtures=next --registries=vlt --dry-run
• docker run --rm -v /tmp/vlt-benchmarks-main-96:/work -w /work vlt-benchmarks-local bash -lc '"'"'bash ./scripts/setup.sh >/tmp/setup.log && GH_REGISTRY="" ./bench run --fixtures=next --variation=registry-clean --registries=npm --runs=3 --warmup=1'"'"'
• docker run --rm -v /tmp/vlt-benchmarks-pr-96:/work -w /work vlt-benchmarks-local bash -lc '"'"'bash ./scripts/setup.sh >/tmp/setup.log && GH_REGISTRY="" ./bench run --fixtures=next --variation=registry-clean --registries=npm --runs=3 --warmup=1'"'"'