#750 run_goal tool execution is at-least-once; needs scoped sub-step for exactly-once

tools.agent.run_goal (issue #749) gates each tool observation with a workflow variable (agent_tool_<turn>_<i>). A crash strictly between a side-effecting tool returning and its gate write can re-run that tool (at-least-once). reflexive_loop avoids this by running as a non-durable Activity; ctx.step gives exactly-once but its checkpoint namespace is shared, so manually invoking arbitrary tools in a loop risks cross-turn checkpoint-name collisions if a tool uses fixed ctx.step names internally. Proper fix: a scoped sub-step / child-context primitive in DurableContext that isolates checkpoint namespaces per tool invocation, OR require idempotency keys inside side-effecting tools. Until then, only mark idempotent or approval-gated tools as available to run_goal in production.