#945 Tenant-published app source escapes restricted builtins: root + docker.sock in worker

EARS: When a workflow task runs a tenant-published app action, the engine shall execute the app source in an OS-level isolation boundary (non-root uid, no docker.sock, no Highway DB/Vault credentials), and shall not rely on restricted __builtins__ as the security boundary. Found during #940 inventory. enterprise/apps/app_runner.py _load_app_instance and enterprise/apps/code_loader.py exec() tenant app source (POST /api/v1/apps/{id}/versions, publisher_id=tenant) in a forked child of the worker, same uid 0, same container (docker.sock mounted). SAFE_BUILTINS exposes type/getattr; validate_source_code does not block dunder attribute access. Reproduced in highway-api container from source copy: payload ().__class__.__base__.__subclasses__() -> os._wrap_close.__init__.__globals__ -> getuid()==0, path.exists('/var/run/docker.sock')==True; validate_source_code ACCEPTED it. Fix needs an app execution redesign (IPC ctx over pipe + network for connectors), so not folded into #940. Options: run AppRunner child under setuid(65534)+no docker group+seccomp/userns, or run apps in a dedicated sidecar container without docker.sock/DB creds talking IPC over a socket.