fix: configure registry for vlt benchmarks

[lukekarrys]

Summary

• configure every benchmark fixture with a project vlt.json that maps the npm alias to https://registry.vlt.io/vlt/npm/
• use vlt's supported VLT_REGISTRY and VLT_TOKEN environment variables for authenticated benchmark runs, with the registry URL kept in the workflow and only the token stored as a secret
• keep the benchmark app on https://registry.npmjs.org/ in both app/vlt.json and app/vlt-lock.json; app builds do not receive the vlt registry credentials
• preserve vlt install --view=silent, remove npm install fallbacks and ignored vlt install failures, and avoid registry CLI arguments or custom auth setup scripts
• use a shallow two-commit checkout for change detection

Validation

• clean isolated benchmark fixture: vlt install --view=silent and vlt run test
• clean app install/build against npmjs: vlt install and vlt run build
• CI benchmark install/run passed with the direct VLT_REGISTRY / VLT_TOKEN configuration