Start every worker thread through the executors module

Thirty-nine spawn sites in dr-ui, and one in the Android entry point,
called std::thread::spawn or a Builder of their own, and most of the
threads they started were <unnamed> in a panic message or a profiler.
Each now calls executors::spawn with its executor and a role, so the thread is
named <executor>:<role> — net:sync, decode:thumbs, io:catalog-open —
and knows which executor it is on. The three that already set a name
(automation, import, prefetch) keep their name as the role.

Behaviour is unchanged: each job still gets a thread of its own when it
starts, and spawn panics where std::thread::spawn did.

The module's documentation now says how a job is assigned: by what it
spends its time on, so a sweep that fetches bytes and then decodes them
is Decode, and a sidecar write that touches the catalog is Network.

Left as they were: the segmentation and refine workers in masks_ui.rs,
which another change is reworking, and test-only threads.

apps/darkroom-android/src/lib.rs

@@ -300,7 +300,9 @@ fn install_bundled_models(app: slint::android::AndroidApp) {
     // on the worker because `AAssetManager` is thread-safe by contract and
     // reading the pointer takes only the app's read lock, which `poll_events`
     // also only ever holds shared.
-    std::thread::spawn(move || unpack_bundled_models(&app));
+    dr_ui::executors::spawn(dr_ui::executors::Executor::Io, "models", move || {
+        unpack_bundled_models(&app)
+    });
 }
 
 /// The copy itself, on the worker [`install_bundled_models`] starts.