fix(modregistry): eliminate parallelWorker deadlock on error path

[ngbinh]

Summary

Fix a latent deadlock in parallelWorker.wait() that fires whenever any task returns an error. Surfaced in production via the formModule Lambda: cue mod publish → parallelPushBlob → blob push to OCI registry errors → goroutine hang at anduin_parallel.go:87 → Lambda timeout after 5 minutes → cascading test failures.

The bug

// Old wait() loop
done := make(chan struct{}, 1)  // capacity 1
go func() { w.wg.Wait(); done <- struct{}{} }()  // watchdog

for {
    select {
    case <-done: return ...
    case err = <-w.errCh:
        w.cancel()
        done <- struct{}{}  // ← race: may block forever
    }
}

Race:

1. Task A errors → errCh <- err
2. Main loop reads err, calls w.cancel(), tries done <- struct{}{}
3. Meanwhile the watchdog goroutine's wg.Wait() unblocks (all workers done) and sends done <- struct{}{}, filling the cap-1 channel
4. Main loop's done <- struct{}{} has no receiver — hangs forever

Additionally, worker goroutines did errCh <- err / respCh <- resp unconditionally. If wait() had already returned (via the error path), those sends would block forever — leaked goroutines.

The fix

• Use context cancellation as the sole termination signal. Main loop no longer touches done.
• Watchdog close(done)s the channel (read-only signal, idempotent, can't be filled twice).
• On error: first error wins, cancel context, keep draining until watchdog closes done.
• Worker sends are guarded with select { case ch <- v: case <-ctx.Done(): } so cancellation unblocks them.
• defer in wait(): cancel + wg.Wait() + close(errCh/respCh) — channels closed only after every worker has left its send site, eliminating the send-on-closed panic risk.

Tests

New regression tests in anduin_parallel_test.go with a 2-second waitWithTimeout watchdog so future regressions fail loud instead of hanging CI:

• TestParallelWorkerErrorNoDeadlock — minimal repro of the reported deadlock
• TestParallelWorkerMultipleSuccess — 16 concurrent successes, ordering preserved
• TestParallelWorkerErrorWithSlowSiblings — error racing against in-flight workers

Validated with go test -race -count=500 ./mod/modregistry/ -run TestParallelWorker.

Test plan

• go vet ./mod/modregistry/...
• go build ./...
• go test -race -count=500 ./mod/modregistry/ -run TestParallelWorker
• Rebuild & deploy formModule Lambda with this fix and verify stargazer CI no longer hangs