docs(haxe): record verification runs

[mstykow]

Summary

• Run compare-outputs --profile common for openfl/openfl@74d8f72, HaxeFlixel/flixel@ec54c5a, and HeapsIO/heaps@d2992b0, then record the verified Haxe benchmark rows in docs/BENCHMARKS.md
• Mark scorecard row 40 (Haxe) as verified after triaging the remaining common-profile deltas as non-regressions rather than ScanCode-better outcomes
• Regenerate docs/benchmarks/scan-duration-vs-files.svg and the benchmark headline stats after adding the new rows
• Compare artifacts:
  • .provenant/compare-runs/20260422T224607Z-openfl-32439
  • .provenant/compare-runs/20260422T225651Z-flixel-45256
  • .provenant/compare-runs/20260422T230021Z-heaps-50135

Scope and exclusions

• Included:
  • Haxe verification documentation updates in docs/BENCHMARKS.md
  • Scorecard status update in docs/implementation-plans/package-detection/PARSER_VERIFICATION_SCORECARD.md
  • Regenerated benchmark chart SVG and headline stats
• Explicit exclusions:
  • No parser or shared scanner code changes
  • No golden updates, because the compare work did not require any accepted behavior changes

Intentional differences from Python

• Keep the already-reviewed Provenant differences that are more informative or cleaner for these targets, including purl-rich winexe identity on OpenFL's bundled executable, compound font-license grouping on Flixel's assets/fonts/monsterrat.ttf, and trailing-slash URL normalization on documented project links

Expected-output fixture changes

• Files changed: none
• Why the new expected output is correct: no scanner behavior changed in this branch, so there were no parser, assembly, or golden fixtures to refresh