Fix SIGABRT/SIGSEGV from concurrent mx::eval dispatch

[ausimian]

Summary

• Root cause: MLX is not thread-safe (ml-explore/mlx#2133). The Metal CommandEncoder is shared state — concurrent mx::eval calls from different OS threads crash with "A command encoder is already encoding to this command buffer" (SIGABRT) or SIGSEGV. M14's soak tests (8 concurrent Task.async_stream workers) were the first to call mx::eval from multiple dirty-CPU scheduler threads simultaneously.
• emily::safe_eval(): mutex-serialised mx::eval wrapper in tensor.hpp. All eval callsites route through it; graph-building ops remain lock-free.
• Removed set_default_stream from with_stream/2: the NIF mutated MLX thread-local state which is unreliable under BEAM process migration between OS threads. Process-dictionary routing was already correct.
• Hardened resolve_stream(-1): avoids reading the (potentially corrupted) thread-local default.
• M15.5 milestone: plan for building MLX from source (0.32+) to restore true concurrent Metal dispatch via upstream ThreadLocalStream (ml-explore/mlx#3405).

Test plan

• Reproduced crash before fix: amplified stress test (16 workers × 100 iters) crashed 2/5 with Metal CommandEncoder assertion
• Full test suite 20× — 0 crashes
• Soak tests 20× — 0 crashes
• Amplified stress test 20× — 0 crashes

🤖 Generated with Claude Code