#908 Platform tenant deactivate/reactivate return 200 but the workflow dies: internal.tenant.suspend/reactivate are never registered

EARS SPEC: - If a workflow task references a tool name that is not present in the tool registry, then the Highway API shall reject the submission rather than returning success and failing later at the worker. - When an operator calls POST /api/v1/platform/tenants/<id>/deactivate, the Highway platform shall suspend the tenant, or return an error explaining why it did not. - When an operator calls POST /api/v1/platform/tenants/<id>/reactivate, the Highway platform shall reactivate the tenant, or return an error explaining why it did not. - The Highway tool registry shall have a startup check asserting every tool name referenced by a shipped platform_core workflow is registered. EVIDENCE (static, verified; not yet executed against a live run): - api/blueprints/v1/platform.py:606 and :717 import get_suspend_workflow / get_reactivate_workflow and submit them via submit_workflow(). - enterprise/platform_core/workflows/tenant_lifecycle.py:179 uses tool 'internal.tenant.suspend'; :225 uses 'internal.tenant.reactivate'. - Neither name appears in any self.register(...) call across api/, enterprise/, docker/highway-core/engine/. Registered internal.tenant.* names are only: create_admin, create_rate_limits, init_rbac, install_apps, mark_bootstrapped, upload_seed_files. - enterprise/platform_core/tools/tenant.py defines suspend (:536), reactivate (:599), delete (:646) and platform_core/tools/__init__.py exports them, but registry.py never registers them. - enterprise/tools/registry.py:48-57 only falls through to the app bridge for names starting with 'apps.'; anything else re-raises KeyError from docker/highway-core/engine/tools/registry.py get(). - Same defect for internal.tenant.create_api_key (api_key_lifecycle.py:184) and internal.tenant.rotate_api_key (:231); enterprise/platform_core/tools/api_keys.py is registered nowhere. IMPACT: submission succeeds and the endpoint returns 200, so an operator believes a tenant was suspended when it was not. Failure is silent from the caller's side. NOT YET DONE: no live reproduction. Next step is to call the endpoint against the running stack and observe the run fail at dispatch.