#1005 Tenant workflows can run internal.* tools: the submit-time internal tool block is never called

EARS SPEC: - If a workflow submitted through POST /api/v1/workflows (or any tenant-facing submit path) references an internal.* function anywhere in its tasks, then the Highway API shall reject it with 403 FORBIDDEN_TOOLS and create no workflow run. - Where an internal.* task reaches a worker from a tenant other than the platform scheduler/CLI path, the engine shall refuse to execute it (defence in depth at execution time). EVIDENCE (found during #996/#978, 2026-10-20 02:25Z, tenant test, public API https://highway.rodmena.co.uk): POST /api/v1/workflows with one task function=internal.health.get_summary returned 201; run 601cf072-e32c-4fab-ac49-7a9ab90e7605 executed on worker 07d44efa4898 (highway_default queue) and completed in 32 ms; result.output = {checks: {api, database, vault, workers: {healthy:false, error:"'function' object has no attribute '__wrapped__'"}}, overall_healthy:false}. CAUSE: api/middleware/validators.py validate_workflow_definition() contains the internal.* block (_check_for_internal_tools, 403 FORBIDDEN_TOOLS) but nothing calls validate_workflow_definition (grep over api, enterprise, docker/highway-core/engine finds only the definition). Same in source HEAD 556c519 and in the deployed image. IMPACT: registry includes internal.platform.create_owner, internal.platform.create_system_tenant, internal.tenant.create_admin, internal.tenant.create_rate_limits, internal.health.send_alert, internal.db_cleanup, internal.reap_zombie_containers (enterprise/tools/registry.py, engine registry). Not exercised: whether those tools take tenant/owner arguments that let a tenant escalate; only get_summary was run. get_summary itself discloses cross-tenant data once #996 is fixed (workflow_run counts across all tenants, db size, every worker id/host). NOT DONE: no fix; reported to the lead from the #978/#996 agent.