#1037 Submission accepts definitions naming tools that are not registered (fails later at the worker)

EARS SPEC (from #908, item 1, not done there): - If a workflow task names a tool that is neither registered nor an apps.* name, then submit_workflow shall reject the definition with 400 WORKFLOW_VALIDATION_ERROR listing the names and task ids, and shall write no definition or run. Open questions: apps.* names (resolved per tenant installation at run time; check installation at submit?), lazily registered tools (tools.workflow.execute_branch), hwec submissions with the core-only registry. #908 added only the platform_core startup check (enterprise/platform_core/workflow_tools.py, called from EnterpriseToolRegistry.__init__).