Railbase core v0.5.22

Plugin runtime concurrency hardening — data-resident plugin verb dispatch is now bounded and parallelisable, so one slow plugin can no longer freeze the whole runtime:

• Bounded host calls — $app.http.fetch / $app.docs.* / $app.ocr run on the verb's deadline context, so the timeout actually cancels a blocking upstream (previously it held the VM lock up to the call's own 30s ceiling).
• Per-plugin limits — author-declared manifest.runtime route timeout + max-concurrency (operator-overridable, hard-clamped); over-cap requests are rejected 503 before taking the lock.
• Dispatch tracing — Runtime.Stats: lock wait/hold + high-water mark, in-flight gauge, per-kind host-call latency, dropped events; WARN on a slow verb or consume reaction.
• Compile-once — plugin sources compile to a *goja.Program; per-job / per-event VMs no longer re-parse.
• Verb VM pool (opt-in, VMPoolSize, default off) — concurrent verbs run on dedicated VMs in parallel: ~9× verb throughput in the blocking-handler benchmark.

Also ships the prior signup / email-verify fixes. Backward-compatible — no config changes required. goja is unchanged; ADR-002/003 invariants intact.

Verify downloads: shasum -a 256 railbase_* against checksums.txt (also at https://railbase.app/dl/checksums.txt).