feat(sdk): parallel pipeline fan-out + typed JSON report with metrics

[ZhiXiao-Lin]

What

Makes the a3s-box-sdk programmable-CI pipeline usable for matrix / parallel CI and produces a machine-readable result.

• Base::run_parallel(steps, max_concurrency) -> Report — runs steps concurrently as isolated copy-on-write MicroVM forks, bounded by max_concurrency, collect-all (every step runs; results returned in input order). Built on std::thread::scope + a work queue — still dependency-free.
• Typed Report / StepResult with to_json() (dep-free encoder): separated stdout/stderr, duration_ms, cached, allow_failure, and metrics parsed from ::metric <key>=<value> lines a step prints to stdout (a scoring channel for matrix/selection workloads).
• Steps now take &self (atomic fork counter). The previous &mut self made the documented "fan out with threads" impossible through the borrow checker.
• Leak-free RAII: each fork is removed on every path (incl. panic) via a guard; the base snapshot is removed on Drop with --force.
• Collision-safe names: box/snapshot names carry per-process + per-instance entropy, so two pipelines from the same image+setup (or two processes on one host) can no longer collide and tear down each other's live boxes.
• Bounded output (WarmBase::max_output, default 1 MiB) so one chatty/looping step can't balloon an in-memory report during large fan-out.
• Distinct INFRA_FAILURE exit sentinel so a scorer can tell "never ran (infra)" from "ran and failed".

Why

The pipeline could previously only run steps sequentially (step took &mut self), so a3s-box's cheap (~110 ms) CoW fork couldn't be used for matrix/parallel CI, and a result was only per-call exit_code + concatenated logs — not a comparable, machine-readable signal. This is the building block for fan-out CI and selection/scoring workloads.

Breaking

• StepResult.logs (field) is removed, replaced by stdout / stderr. Use StepResult::combined() for the old concatenated view. (Documented under ### Changed.)

Validation

• cargo test -p a3s-box-sdk — 15 unit tests + doctest; cargo clippy clean.
• End-to-end on a real /dev/kvm host (a3s-box 2.5.1):

read   -> code=0 out="DEPS-INSTALLED"        # real boot + snapshot + CoW fork + exec
read#2 -> cached=true                         # content-addressed cache hit
report -> {"passed":false,"total_ms":2018,"steps":[
  {"name":"ok",  "exit_code":0,"duration_ms":62,"metrics":{},"stdout":"fine\n"},
  {"name":"perf","exit_code":0,"duration_ms":67,"metrics":{"duration_ms":12.5},...},
  {"name":"fail","exit_code":7,"duration_ms":94,...}]}
passed=false failures=["fail"]
leak check: 0 ci-base boxes, 0 snapshots

Real microVM boot, CoW fork-per-step, parallel fan-out, ::metric extraction from a live guest, typed JSON report, and zero leaked boxes/snapshots.

Dependency-free throughout; no new crates.