fix(js): use shared runtime and concurrency limit for tool callbacks

[chaliy]

Summary

• Replace unbounded std::thread::spawn + per-call Runtime::new() with a shared lazily-initialized tokio runtime (2 worker threads)
• Add semaphore with 10 permits to cap concurrent in-flight tool callbacks
• Prevents OS thread exhaustion from scripts invoking tools in loops

Test plan

• Tool callbacks still execute correctly
• Concurrent tool invocations bounded by semaphore
• cargo check -p bashkit-js passes
• No thread exhaustion under heavy tool callback load

Closes #982