#407 HTTP Idempotency-Key auto-injection for exactly-once semantics

Review Gap 1: Side-Effect Atomicity. HTTP requests in tools.http.request execute BEFORE transaction commits. If worker crashes post-execution but pre-commit, retry duplicates the side effect. Fix: Auto-inject deterministic Idempotency-Key header derived from ctx.workflow_run_id + step_name for exactly-once semantics on receiver side. Location: engine/tools/http_request.py