`symlink_fut`'s per-snapshot future is entirely synchronous (mkdir +
rayon-parallel `create_symlink_layout`) with no `.await` points.
`futures::try_join_all` polls its children on the same task, so without
a blocking hint each child ran to completion on the worker thread
before the runtime got a chance to poll `fetch_fut` — coupling
download progress to symlink wall-time on the multi-threaded runtime
and undoing the parallelism the previous commit was aiming for.

Wrap the body in `tokio::task::block_in_place` so the executor can
shift `fetch_fut` and other tasks onto sibling workers while this
thread blocks. Pnpm's JS equivalent gets the same effect for free via
`@pnpm/worker`, which offloads symlink work to a worker thread pool.

The existing `#[tokio::test]` that reaches `CreateVirtualStore::run`
uses an empty snapshot set, so the map closure is never invoked and
`block_in_place` is never called from current-thread tokio — no panic.

Replace the per-snapshot `block_in_place` pattern from the previous
commit with a single `tokio::task::spawn_blocking` that owns the
symlink work and distributes it across rayon's pool via a flat
`par_iter`. Three wins:

1. No runtime-flavor fragility. `block_in_place` panics on current-
   thread tokio; `spawn_blocking` works everywhere. Nothing in the
   codebase relies on this today, but the previous shape was a trap
   for a future test that adds non-empty snapshots under
   `#[tokio::test]` without `flavor = "multi_thread"`.
2. Clean error propagation. `create_symlink_layout` now returns
   `Result<(), SymlinkPackageError>` (serial `try_for_each` instead
   of `par_iter().for_each` with an `.expect`), and the error
   threads up through a new `CreateVirtualStoreError::SymlinkPackage`
   variant. A filesystem failure during the symlink sweep now
   surfaces as a structured miette diagnostic instead of crashing
   the process mid-install.
3. Better rayon work queue. One `par_iter` over the full snapshot
   vector lets rayon schedule 1352 items across its workers in one
   pass, instead of 1352 ramp-up/ramp-down cycles of the previous
   nested `par_iter`-per-snapshot pattern.

`snapshot.dependencies` (a small `HashMap<PkgName, SnapshotDepRef>`)
is cloned once per snapshot so the task owns its data. On the
1352-package fixture this is a few tens of ms of one-off work vs.
the per-iteration savings and the robustness wins; big-lockfile
integration test runs in 47–50s either way.

Also corrects the stale doc on `CreateVirtualDirBySnapshot` — after
the split, the virtual-store package directory may or may not exist
when CAS import runs, and `link_file` creates missing parents on
demand.

The previous version fanned the symlink pass out over rayon via
`par_iter` inside a `spawn_blocking`. On cold-cache installs this
stole rayon workers from the fetch branch's concurrent
`create_cas_files` calls during the hot part of the install and
showed up as ~4% regression on the 1352-package FrozenLockfile
benchmark relative to main.

Pnpm's JS equivalent already solved this: `symlinkAllModules`
(`worker/src/start.ts:493-501`) runs as a plain nested `for` loop on
a single `@pnpm/worker` thread — no internal parallelism, no
contention with the main-thread `linkAllPkgs` work. Port that
pattern: drop the outer `par_iter`, iterate the snapshot vec
serially in the `spawn_blocking` closure.

On Linux with num_cpus workers, the cold install has ~3 s of network
and tarball-extract work; ~6-7k symlink syscalls serial on one CPU
costs ~200-300 ms, which sits comfortably inside the fetch budget
and frees the whole rayon pool for CAS imports. No change to the
symlink/fetch concurrency contract — `spawn_blocking` still runs on
its own thread concurrently with the fetch `try_join_all`.

Previous commits on this branch hoisted the whole symlink pass into a
separate `spawn_blocking` task that ran concurrently with the fetch
`try_join_all`. On the 1352-package cold-install benchmark that
design shipped a ~3% regression vs. main, and I couldn't find a safe
way to eliminate the root cause (an upfront `snapshot.dependencies.clone()`
loop on the reactor thread that required ~50 k heap allocations
before fetches could start).

Go back to baseline's per-snapshot tokio-task shape and add the
parallelism one level deeper instead: inside each snapshot's post-
extract step, `CreateVirtualDirBySnapshot::run` now uses `rayon::join`
to run `create_cas_files` and `create_symlink_layout` concurrently.
Neither closure needs data the other produces — CAS import reads
`cas_paths`, symlink layout reads `snapshot.dependencies` — so
overlapping them saves the serial symlink time per snapshot (~1-3 ms
on a typical package) without any cross-thread data marshaling. Both
closures borrow from the same stack frame.

Cross-snapshot concurrency keeps streaming through tokio's
`try_join_all`, same as main. Pnpm's `deps-restorer` installer is
structured along the same axis once you stop conflating its "symlink
all / fetch all" worker-thread plumbing with wall-time parallelism —
the real overlap that matters is symlink-with-import, not
symlink-with-download.

Keeps the error-propagation cleanup from earlier commits on this
branch: `create_symlink_layout` still returns `Result`, and
`CreateVirtualDirBySnapshot` grows a `SymlinkPackage` variant so a
filesystem failure during the symlink sweep no longer panics the
process mid-install.