Railbase core v0.5.23

Plugin-runtime concurrency: close the v0.5.22 gaps.

• Reachable VM pool. RAILBASE_VM_POOL_SIZE now wires the Compile-once verb VM pool that shipped (dormant) in v0.5.22. Unset/0 = off (default, single-VM as before); auto = GOMAXPROCS; N = fixed pool. Operators enable it when blocking host calls (network $app.http.fetch, OCR) make the single-VM serialization a head-of-line bottleneck — the symptom seen as minute-long stalls under network load.
• Runtime stats endpoint. GET /api/_admin/plugin-runtime/stats (admin-gated) exposes the goja dispatch counters: verb-lock wait/hold + worst single hold (head-of-line high-water), in-flight gauge, 503 rejections, per-kind host-call latency, eventbus drops.
• translate /document is async-by-default. It enqueues the same background worker as POST /jobs and returns 202 + a job id instead of running extract → translate → render inline under the goja VM. (Pairs with translate v0.2.6.)

Pinned vendor keys + data-resident plugin key unchanged from v0.5.7+. SHA-256 in checksums.txt.