fix(concurrency): fail-fast page fan-out that keeps exception identity

[P4suta]

Stacked on #29. Combines the substrate rewrite and the 7-site migration in one PR: the build compiles with -Xlint:deprecation -Werror, so a deprecated migration window is not possible.

The defects (all verified in code)

1. No fail-fast. Tasks.awaitAll (and its two private copies in despeckle/register) used invokeAll, which waits for every page even after the first failure — a corrupt page at position 1 of 600 still ran the other 599.
2. Error kinds destroyed at the pool boundary. A worker's domain exception (DespeckleException/RegisterException — RuntimeExceptions carrying their ErrorKind) was wrapped into a generic IOException, so ExceptionMapper saw INTERNAL instead of the real kind: wrong exit code, wrong RunFailed token in the webapp's SSE stream. (despeckle's copy even wrapped IOExceptions, losing the page name.)
3. ProcessRunner leaked the child on interrupt: InterruptedException from waitFor propagated without destroyForcibly, leaving the drainer close() hanging on a live child's pipes.
4. Ctrl-C leaked the work area: no finally ran on SIGINT, so the whole p4suta-pipeline- temp tree of intermediates remained.

The new substrate (shared/process Tasks)

Batch-owned executor (try-with-resources) with StructuredTaskScope.join() semantics on final-Java features (preview stays off; a future swap to JEP 505 is internal-only):

• Fail-fast + sibling interruption, plus a failure gate that stops queued tasks a freed worker dequeues in the shutdownNow race window (caught by the test that pinned this race).
• Quiescence before the failure propagates — close() joins every worker, so the callers' finally-deletes (PipelineRunner, RegistrationService scratch) can never race in-flight writers.
• Exception identity preserved: IOException/RuntimeException unchanged, UncheckedIOException unwrapped — kinds and exit codes are now correct on page failures.
• Two scheduling modes: Workers.platform(jobs) for CPU-bound Leptonica/FFM work (long downcalls pin virtual threads' carriers — virtual would silently cap -j at core count), Workers.virtual(maxInFlight) for subprocess waits (pdfimages chunks, per-page jbig2), semaphore-bounded.
• ItemProgress fires on the orchestrating thread in completion order — per-page progress is now strictly ordered, and the AtomicInteger counter at every call site is gone.

Migration (all 7 sites)

G4EncodeStage, DespeckleService, RegistrationService (both passes), PdfExtractSource, shared extractor/assembler (ports lose the ExecutorService parameter), Jbig2PackService, both PdfPipelineServices — whose redundant outer pools that sat idle through the whole middle step are removed. The dead NativeTools.awaitAll copies (zero callers) are deleted.

Ctrl-C cleanup

Main installs a shutdown hook that interrupts the run and waits (bounded, 15s) for it to unwind; a latch makes the normal-exit path return immediately. Verified in-container: SIGINT to the process group aborts the run (exit 130, Error[INTERNAL] reported), children killed, no work dir remains. (Note for testers: signaling a non-job-control background launcher doesn't deliver SIGINT — the JVM honors an inherited SIG_IGN; a real terminal Ctrl-C delivers to the foreground process group.)

Tests

• TasksTest: 12 deterministic, latch-coordinated tests — submission order, orchestrator-thread ordered progress, exception identity (assertSame) for IO/Runtime/UncheckedIO, label-wrapped unknown checked, fail-fast + sibling interrupt + queued-skip, quiescence (in-flight counter is 0 when the throw reaches the caller), caller interruption (flag restored, workers joined), virtual-mode in-flight bound, limit validation.
• ProcessRunnerTest: interrupted waiter kills the child and unwinds promptly (bounded join is the proof; pre-fix this hung on the drainers).
• Two existing tests that pinned the old wrap-everything behavior updated to pin the new identity-preserving contract.
• Full ./gradlew check green; benchmark shows no regression (conv 14.29s vs 14.23s at -j8).

🤖 Generated with Claude Code

Re-file of #30 (same commits, cherry-picked onto main; the original was orphaned by stacked squash merges).