refactor(tests): explicit HERMES_TEST_WORKERS over docker-suite auto-cap

Replace the runner's tests/docker auto-cap heuristic with explicit
width control:

- run_tests.sh forwards HERMES_TEST_WORKERS through its hermetic env -i
  (previously silently stripped — the documented override never worked
  through the wrapper)
- run_tests_parallel.py drops the _DOCKERD_BOUND_JOBS special-case; the
  suite-specific knowledge moves to the one place that runs that suite
- docker.yml pins HERMES_TEST_WORKERS=8. Width sweep with prewarmed
  image + split files: -j4 58-62s, -j8 39s, -j12 35s w/ ~2x per-file
  contention inflation; 8 is the knee.

Chain verified end-to-end: env var reaches the runner (6-worker probe),
no cap message on docker-only file lists, full suite 53/53 in 37.8s
at -j8.

.github/workflows/docker.yml

@@ -150,10 +150,16 @@ jobs:
           command: uv sync --locked --python 3.11 --extra dev
 
       - name: Run docker integration tests
+        # HERMES_TEST_WORKERS=8: this suite shares ONE dockerd, so width
+        # is daemon-bound, not CPU-bound. Width sweep with prewarmed image
+        # + split files (2026-07): -j4 58-62s, -j8 39s, -j12 35s but with
+        # ~2x per-file contention inflation at 12. 8 is the knee.
+        # run_tests.sh forwards HERMES_TEST_WORKERS through its hermetic
+        # env -i into the parallel runner.
         uses: ./.github/actions/profile
         with:
           label: docker-tests
-          command: HERMES_TEST_IMAGE="${{ env.IMAGE_NAME }}:test" scripts/run_tests.sh tests/docker/ --file-timeout 600
+          command: HERMES_TEST_WORKERS=8 HERMES_TEST_IMAGE="${{ env.IMAGE_NAME }}:test" scripts/run_tests.sh tests/docker/ --file-timeout 600
 
   # ---------------------------------------------------------------------------
   # Rebuild and push each architecture only after the unprivileged build/test

scripts/run_tests.sh

@@ -149,6 +149,7 @@ exec env -i \
   LC_ALL=C.UTF-8 \
   PYTHONHASHSEED=0 \
   PYTHONUTF8=1 \
+  ${HERMES_TEST_WORKERS:+HERMES_TEST_WORKERS="$HERMES_TEST_WORKERS"} \
   ${HERMES_RUN_SLOW_PET_TESTS:+HERMES_RUN_SLOW_PET_TESTS="$HERMES_RUN_SLOW_PET_TESTS"} \
   ${HERMES_E2E_BROWSER:+HERMES_E2E_BROWSER="$HERMES_E2E_BROWSER"} \
   ${EXTRA_PYTHONPATH:+PYTHONPATH="$EXTRA_PYTHONPATH"} \

scripts/run_tests_parallel.py

@@ -967,27 +967,6 @@ def main() -> int:
         test_counts = {f: test_counts[f] for f in files if f in test_counts}
         approx_total_tests = sum(test_counts.values())
 
-    # Docker-suite auto-cap: tests/docker files all funnel through a single
-    # docker daemon, so parallel width is bounded by dockerd, not CPU.
-    # Running the suite at cpu*2 width thrashes the daemon (files stretch
-    # from ~100s to ~900s, teardown `docker rm` blows its timeout). Cap at
-    # 4 unless the user explicitly chose a width (-j or HERMES_TEST_WORKERS).
-    _DOCKERD_BOUND_JOBS = 4
-    jobs_explicit = (
-        os.environ.get("HERMES_TEST_WORKERS")
-        or any(a == "-j" or a.startswith(("--jobs", "-j")) for a in sys.argv[1:])
-    )
-    if not jobs_explicit and files and all(
-        "tests/docker/" in str(f).replace(os.sep, "/") for f in files
-    ):
-        if args.jobs > _DOCKERD_BOUND_JOBS:
-            print(
-                f"Docker suite detected (single dockerd bottleneck): "
-                f"capping workers {args.jobs} -> {_DOCKERD_BOUND_JOBS}",
-                flush=True,
-            )
-            args.jobs = _DOCKERD_BOUND_JOBS
-
     if roots:
         roots_str = [str(r.relative_to(repo_root)) if r.is_relative_to(repo_root) else str(r) for r in roots]
         print(