Authentik works several objects at a time; FreeIPA sends in batches

[fadwen]

Follows #41, #42 and #43, now merged.

What

Authentik. Core/Invoke-TestParallel.ps1 runs a block over many items on a runspace pool whose workers import the module, on Windows PowerShell 5.1 and 7 alike. New-AuthentikUser builds every row's request in the main runspace (the ShouldProcess call, progress, group resolution) and creates four at a time; the teardown's per-type sweep confirms each item first and deletes four at a time, except groups, which keep one worker because a group goes before the group it nests under. A worker has the module's functions and none of the session's state: the block takes the connection through -Parameter, and a new contract test refuses any $script: read inside a worker block, as the existing one does for Start-Job bodies.

FreeIPA. Invoke-FreeIPABatch sends the users, hosts and DNS records fifty to a request through the realm's JSON-RPC batch method, one answer per command in order. A refused command fails alone, an expected error name (EmptyModlist, NotFound, AlreadyInactive) is ignored per command, and a request the realm could not take fails every command in it with the same message. Each row is still decided, confirmed and reported one at a time.

Measured on the labs

	Before (today)	After
Authentik seed	8:22	6:18
Authentik teardown	7:34	4:36
FreeIPA seed	13:22	11:48

The FreeIPA gain is small and the changelog says why: the realm's own work per user (private group, memberof) is most of the time, not the round trip. The batching stays because it is the right shape and a faster realm would reward it. Both cycles verified with every check passing after the seed and nothing of the module's after teardown.

Tests

• Core/Invoke-TestParallel.Tests.ps1 runs real workers with no network: results in input order whatever order workers finish, the block inside the module (a private function in reach), one item's exception failing that item alone, no session state in a worker.
• Providers/FreeIPA/Invoke-FreeIPABatch.Tests.ps1: wire shape with the API version, chunking, per-command refusal, ignored error names, a failed chunk, an unanswered command.
• The Authentik user and teardown suites mock Invoke-TestParallel with a body that runs the block inline (Pester mocks do not reach a worker); the FreeIPA user, host and DNS suites mock Invoke-FreeIPABatch with a shim that records each command as its own call, so their assertions stay about the commands.

Gates

Unit suite 2,642 passed shuffled on 7 (1 skipped) and 2,643 on 5.1, 0 failed. Analyzer clean. Rehearsal passes. CHANGELOG, provider READMEs (timings), Tests/README and a CLAUDE.md invariant.