perf(restore): parallelize per-file fsync in finalize phase

Restore finalization called sync_all() serially for every regular file,
making file count the dominant runtime term on metadata-heavy restores
(~8 min per 100k-file batch observed on ext4 and XFS).

Finalize now runs on a bounded thread::scope pool sized by the new
restore_finalize_concurrency() (connections, floored at 2 per
benchmarks). Durability semantics are unchanged: same per-file
sync_all, fsync failure stays fatal, dest_root fsync still follows all
workers.

Workers share one warning budget through a WarningSink locked only on
the error path, so MAX_RESTORE_WARNINGS bounds the log stream globally.
The join-and-first-error tail shared with the Phase 4 chunk readers is
extracted as join_workers(). Single-file calls take a serial fast-path,
keeping the thread-local test fault harness on the calling thread; the
multi-worker path is covered by real-failure tests.

Author: m3nu