Performance Tweaks Without Semantic Drift: Optimize, Then Re-Prove