#16 Chore/atomic cleanup 25 commits

Summary by cubic

Renamed the binaries to preloop-runner and preloop-server, added pause-on-failure debug sessions, and improved dispatch, parsing, and snapshot performance. New CI validates runner compatibility; a new benchmark harness measures end-to-end latency.

• New Features

  • Pause-on-failure debugging: worker holds on a failed step, long-polls for a verdict, and server suspends timeouts; new /api/v1/debug/* endpoints and tests.
  • Scoped GITHUB_TOKEN via GitHub App: mint short-lived installation tokens per run; checks API uses App tokens when available, falling back to AKSH_GITHUB_TOKEN.
  • Orchestrator signals and bridging: server publishes queue depth and next job labels; runner prints a “busy” line when a job starts; optional PRELOOP_RUNNER_RSA_PARAMS to skip keygen; in-guest control-plane TCP bridge to a mounted Unix socket.
  • Parser/runtime upgrades: default token permissions, permission scope expansion, selected-jobs dependency closure, github.workspace in context, and a bounded parsed-expression cache for faster eval.
  • Storage and snapshots: faster, safer workspace snapshots; prune on-run completion; bound replay log directory.
  • CI, conformance, and benches: split server vs runner conformance (runner-conformance.yml added); corpus checker and light/deep profiles; new benchmarks/preloop-perf with preloop-loadtest and a Python harness.

• Migration

  • Use preloop-server and preloop-runner (was aksh-runner-server and aksh-runner); scripts and workflows updated accordingly.
  • Bundled Node is now required; system Node fallback was removed and PATH is no longer mutated. Re-run runner configure without --no-externals to download externals.
  • Optional: set GitHub App credentials to enable scoped GITHUB_TOKEN minting; otherwise the server uses AKSH_GITHUB_TOKEN if present.
  • Optional: set PRELOOP_RUNNER_RSA_PARAMS with an RSAParameters JSON blob to speed runner provisioning.