Carry the caller's context into render_scene and refresh worker pools (#80)

[thorwhalen]

Fixes #80.

iter_render_scene (concurrency > 1) and refresh_full_docs handed work to a ThreadPoolExecutor without copying the caller's context, so a key bound with using_fal_credentials was invisible in the workers and render_scene's fal calls fell back to the operator's env key. Each task is now submitted as copy_context().run(fn, ...) (one copy per task; a Context cannot be entered by two threads at once), the same as execute_plan. refresh_full_docs makes only unauthenticated doc fetches today, so it is a consistency fix there.

Tests (fake transport, made-up marker key, no network): a render_scene worker authenticates with the bound key via SyncClient(key=...) rather than the module-level env path; the refresh pool sees the caller's context. Both fail on main, pass here. Full suite: 707 passed, 1 skipped; ruff clean.

Independent review (fresh Opus subagent, tried to break the diff): land it. No defect in the key-carrying fix; no other thread/pool hand-off in falaw loses context (execute_plan already copies); no key leaks between concurrent callers (copy taken at submit time); the new tests fail on main (checked in a main worktree). One confirmed regression in my first version: swapping pool.map for submit in refresh_full_docs stopped cancelling pending fetches after the first error (40 of 40 fetched vs 3 of 40). Fixed: pool.map over per-task context copies. Caveat, not a defect: iter_render_scene is a generator, so the context is captured at the first next(), not at the call.