#916 P0c: Move cancel-time container cleanup to worker; drop docker.sock from api

EARS SPEC: - When a workflow is cancelled, a worker task shall remove its containers. - The api container shall not mount /var/run/docker.sock. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.