#934 Later: RunFlow replaces tools.docker.* after feature request delivered

EARS SPEC: - When RunFlow ships the requested safe feature subset, tools.docker.run shall be versioned onto RunFlow and docker.sock removed from workers. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.