perf(install): download dependencies in parallel

[Chemaclass]

Context

bashdep::install (bashdep) loops over deps and downloads them sequentially — N deps = N serial curl/wget calls. For a .bashdep with many URLs, wall-time is the sum of all downloads.

Scope

• Run downloads concurrently with background jobs + bounded wait (Bash 3.2 has &/wait; no GNU parallel).
• Cap concurrency (e.g. a small fixed pool, default 4; consider BASHDEP_JOBS).
• Serialize lockfile writes — _lock_set must not race. Collect results, write the lockfile after the parallel batch (see the batching issue), or guard with a critical section.
• Preserve the capped failure-count return and per-dep logging.

Acceptance criteria

• Installing K deps issues downloads in parallel, not serially
• Lockfile is never corrupted under concurrency (deterministic final content)
• Failure count semantics unchanged; a failure in one dep does not abort others
• dry-run/silent/verbose/force still honored
• New tests cover: parallel success, one-failure-among-many, lockfile integrity

Out of scope

Progress bars; changing the .bashdep format.

---

Constraints (apply to all bashdep work)

• Bash 3.2+ compatible — no declare -A, ${var,,}/${var^^}, mapfile, negative array index, &>>.
• Zero runtime deps beyond curl/wget/awk/mktemp/mkdir/rm/cp/mv/printf/cat/grep/sort/tr/dirname/basename + shell builtins.
• TDD: write the failing test first (tests/unit/*_test.sh), then implement; keep make test green for the right reason. Mock curl/wget — no network in tests.
• Quality gate: make test && make sa && make lint must all pass.
• Update docs/api.md / docs/behavior.md when public API or semantics change; add a CHANGELOG.md ## [Unreleased] entry for any user-visible change.
• Conventional commits (ref: for refactors); never mention AI/automation. One PR per issue, assigned to Chemaclass.