ci: add opt-in tenant-parallel BVT execution

[Ariznawlll]

Summary

• replace the Python planner and JSON policy with one reviewable Bash directory map
• run mo-tester directly with directory-level -i values
• keep one runner and one MatrixOne deployment per existing BVT group
• run ordering-sensitive cases as sys, two isolated ordinary-tenant workers concurrently, then privileged/global cases as sys
• keep the current run_bvt_group.sh path unchanged unless tenant_parallel_enabled is explicitly true

Directory audit

Audited against MatrixOne main f6dab28046d70412cec132f0068840896852101c:

Phase	Directories	Scripts
sys-before	5	29
ordinary-tenant parallel	27	175
sys-after	40	935
existing optimistic exclusion	1	22

• all 73 top-level directories are classified exactly once
• analyze and benchmark run as sys because they contain snapshot/account-global behavior
• account/tenant, snapshot/PITR, publication, explicit-user, task, failpoint, system, and other global directories run as sys
• unknown future directories default to sys-after using the same group hash as run_bvt_group.sh

Runtime safety

• fixed two workers, each with its own MatrixOne account and copied mo-tester/resource/report directories
• include values are absolute top-level directory paths ending in /; no individual SQL file is scheduled
• both worker process groups are waited for before account deletion
• worker failure still waits for its sibling and runs reachable sys-after after successful cleanup
• signals stop and wait for workers before cleanup
• worker-account leak detection fails the job
• generated password and syspass values are redacted before artifact upload
• feature remains disabled by default

Validation

• Bash syntax validation passed for both runtime shell files
• both workflow YAML files parsed successfully
• the static map selects 36 disjoint directories in group 0 and 36 in group 1
• the MatrixOne main audit found no missing, duplicate, or unknown directory
• git diff --check passed
• the repository's Validate GitHub Actions workflows check passed

Opt-in trial

The MatrixOne caller must reference this CI branch and pass:

uses: matrixorigin/CI/.github/workflows/e2e-compose-parallel.yaml@codex/tenant-parallel-bvt
with:
  bvt_group: ${{ needs.bvt-group-plan.outputs.compose_group }}
  bvt_generation: ${{ needs.bvt-group-plan.outputs.generation }}
  tenant_parallel_enabled: true
  ci_ref: codex/tenant-parallel-bvt

Use the equivalent standalone workflow call for the complementary group.
Because MatrixOne uses pull_request_target, a test PR cannot replace its own
base workflow; the safe shadow-run route is a fork default branch configured
to call this CI branch. This PR stays Draft until that live run is compared
with the serial baseline for coverage, cleanup, failures, and wall-clock time.

Context: matrixorigin/matrixone#26310