perf(sync-executor): drive HTTP fetches through one real top-level runtime

Replace sync_executor::block_on's reactor-less busy-spin poller with
tokio::task::block_in_place + Handle::current().block_on(), riding a
single tokio Runtime entered once in main.rs (falling back to a
disposable one when no ambient runtime exists, e.g. in tests). This
lets HttpDownloader::dispatch await CurlDownloader::download directly
instead of bouncing through the separate curl_runtime() bridge, which
is now deleted.

Manual create-project verification against the real network caught a
concurrency bug this exposed: async_fetch_file held http_downloader's
RefMut across the await on add(), which only panics once downloads
genuinely overlap. add() only needs &self, so borrow() fixes it.

With everything now sharing one real reactor, the FuturesOrdered
fan-out added for ComposerRepository::get_security_advisories/
load_async_packages finally overlaps for real: fetching 8 packages'
metadata dropped from ~7-40s to a consistent ~3-4s in a before/after
comparison, with identical resulting lock files.

sync_executor::block_on's call sites are still synchronous rather
than async fn propagated up to Command::execute, which remains the
end goal (see the TODO(phase-e) in sync_executor.rs) - nested block_on
calls elsewhere don't get this same overlap, only prevented panics.

1 files changed, 13 insertions, 0 deletions

diff --git a/crates/shirabe/src/main.rs b/crates/shirabe/src/main.rs
index 8e8e3299..2ae6d903 100644
--- a/crates/shirabe/src/main.rs
+++ b/crates/shirabe/src/main.rs
@@ -8,6 +8,19 @@ fn main() {
     std::sync::LazyLock::force(&PHP_ENV);
     std::sync::LazyLock::force(&PHP_SERVER);
 
+    // The single process-wide tokio Runtime. `shirabe::run` and everything under it
+    // (Command::execute and friends) is still synchronous top to bottom; entering the runtime
+    // here (rather than driving `run` via `.block_on`) just makes it ambiently available via
+    // `Handle::try_current()` for `util::sync_executor::block_on`'s many scattered call sites,
+    // which ride it through `tokio::task::block_in_place` instead of each spinning up (or
+    // busy-spin-polling without) their own. See sync_executor.rs for the TODO(phase-e) tracking
+    // the eventual goal of propagating `async fn` all the way up to here instead.
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()
+        .expect("failed to build the top-level tokio runtime");
+    let _runtime_guard = runtime.enter();
+
     let result = shirabe::run(std::env::args().collect());
     let exit_code = match result {
         Ok(exit_code) => exit_code,