debug: add /debug/render-bench route for one-shot Chromium timing

Read-only FastAPI endpoint mounted on the Space's parent app.
Sequentially times `render_step` against each fixture's input.step
in cadgenbench-data and returns per-fixture seconds + view count.
Used to compare per-render cost on the Space's container vs a
local reference when eval has been timing out at the 120s
render_step ceiling but nothing on the render path changed in our
code. Curl-fetchable under Bearer auth (the Space is private):

curl -H "Authorization: Bearer $HF_TOKEN" \
https://<space>.hf.space/debug/render-bench

Not user-visible (no UI), no side effects, no row writes. Safe to
remove once the diagnosis lands.

app.py

@@ -421,6 +421,53 @@ app.add_api_route(
     serve_report,
     methods=["GET"],
 )
+
+
+def debug_render_bench() -> dict:
+    """One-shot render-timing probe.
+
+    Sequentially times ``render_step`` on each cadgenbench-data input
+    STEP. Reads-only; no side effects. Used to compare per-render
+    cost on the Space's container vs. a local reference, when an
+    eval has started timing out at the 120s render_step ceiling but
+    nothing on the render path changed in our code.
+
+    Run via:
+      curl -H "Authorization: Bearer $HF_TOKEN" \
+        https://<space>.hf.space/debug/render-bench
+    """
+    import time
+    from cadgenbench.common.paths import data_inputs_dir
+    from cadgenbench.common.viewer import render_step
+
+    base = Path(data_inputs_dir())
+    results: dict = {}
+    for fixture in sorted(p for p in base.iterdir() if p.is_dir()):
+        step = fixture / "input.step"
+        if not step.exists():
+            results[fixture.name] = {"error": "no input.step"}
+            continue
+        t0 = time.perf_counter()
+        try:
+            imgs = render_step(str(step), timeout=180)
+            dt = time.perf_counter() - t0
+            results[fixture.name] = {
+                "ok": True, "seconds": round(dt, 2), "views": len(imgs),
+            }
+        except Exception as e:  # noqa: BLE001 - report whatever fails
+            dt = time.perf_counter() - t0
+            results[fixture.name] = {
+                "ok": False, "seconds": round(dt, 2),
+                "error": f"{type(e).__name__}: {str(e)[:300]}",
+            }
+    return results
+
+
+app.add_api_route(
+    "/debug/render-bench",
+    debug_render_bench,
+    methods=["GET"],
+)
 app = gr.mount_gradio_app(app, blocks, path="/")