#940 tools.python.run imports and calls any importable module.function on the worker

EARS: If a workflow task names a function for tools.python.run, the engine shall only import and call functions from an explicit allowlist of modules, and shall not import or importlib.reload arbitrary modules on the worker. Found during #915/#939. engine/tools/python_task.py run_python_task does importlib.import_module(module_path) and importlib.reload(module) for ANY tenant-supplied dotted name, then calls func(ctx, *args, **kwargs) in the worker process (root, docker.sock, DB pool, Vault tokens in env). ctx is forced as the first argument, which blocks the obvious os.system/subprocess gadgets, but import side effects, reload of engine modules (global state reset in a live worker), and any callable that accepts an arbitrary first object remain. ARTIFACT mode also exec()s stored source in-process. Not fixed by #915 (sandbox covers shell/code.exec/app shell only). Needs: module allowlist (config), no reload of non-allowlisted modules, and a gadget audit.