[egorsmkv]

Upload inspection and mirrored-wheel extraction/audit previously ran synchronously inside async use cases, stalling the event loop under concurrent load. Move these stages to one shared, process-wide Rayon worker with asynchronous admission. Transfer existing owned payloads without adding a full-buffer clone; retain admission until actual worker completion even if its request is cancelled. Preserve inspection errors and the existing mirror audit log-and-continue policy.

Adds a focused concurrency benchmark, cancellation/panic/error regression test, raw measurements, and reproduction instructions in docs/artifact-concurrency.md. Storage/streaming APIs remain unchanged.

Synthetic wheel with ~16 MiB contents, concurrency 32, one async worker; median of three fresh processes, optional scanners excluded:

Stage	Worst heartbeat delay, inline → offload	Jobs/s	Peak RSS MiB
Upload, deflated	73.76 → 1.68 ms	428.03 → 414.55	11.88 → 11.88
Audit, deflated	490.55 → 1.88 ms	65.10 → 65.51	20.09 → 20.12
Audit, stored	533.03 → 1.83 ms	59.92 → 56.83	531.41 → 531.36

Tradeoff: on two async workers, deflated audit throughput falls from 106.39 to 65.79 jobs/s; worst heartbeat improves from 288.79 to 1.85 ms and RSS from 36.24 to 20.02 MiB. The conservative one-worker limit bounds active snapshots, not waiting input buffers, and does not establish safe production HTTP concurrency. Measurements isolate CPU stages rather than end-to-end HTTP throughput; YARA/FoxGuard/AST/Magika, network, storage writes, and mirror digest validation are excluded.

Validation: 62 application tests pass; all three final benchmark matrices pass their opt-in regression check; infrastructure library/examples check and optimized benchmark build pass with no default features; formatting, whitespace and Python syntax checks pass. Application Clippy passes with two existing Rust 1.99 lints allowed (double_must_use and unnecessary_sort_by). Existing no-default-feature test builds contain unrelated ungated AST/storage tests; full scanner/backend/platform test coverage is not claimed.