#939 tools.shell.run can drive the docker CLI over the mounted docker.sock, bypassing the #914 docker policy gate

EARS: If a workflow task runs a shell command, it shall not be able to reach the Docker daemon. Workers mount /var/run/docker.sock and ship the docker CLI, so tools.shell.run 'docker run --privileged -v /:/h ...' gets around engine/tools/docker/policy.py completely. Belongs with #915 (shell sandbox on by default, fail-closed). The docker host is also shared with other platforms (crypto-trader, ledger, pdfapi, tokengate, tracker), so the blast radius goes beyond Highway.