fix(tests): auto-cap docker-suite workers in the runner itself

Move the dockerd-bound worker cap from a workflow env var into
run_tests_parallel.py: when every file in the run is under
tests/docker/, cap -j at 4 (the suite shares one docker daemon; width
beyond that thrashes it — files stretch ~100s -> ~900s and teardown
docker-rm calls blow their 10s timeout). Explicit -j or
HERMES_TEST_WORKERS always wins; mixed file lists are unaffected.
Verified: docker-only list caps 32->4, -j 12 respected, mixed list
uncapped. Drops the HERMES_TEST_WORKERS=4 pin from docker.yml.

.github/workflows/docker.yml

@@ -119,15 +119,13 @@ jobs:
           command: uv sync --locked --python 3.11 --extra dev
 
       - name: Run docker integration tests
-        # HERMES_TEST_WORKERS=4: this suite shares ONE dockerd — parallel
-        # width is bounded by the daemon, not CPU. At cpu*2 workers (16 on
-        # the 8-CPU ARC pods) dockerd thrashes: every file takes ~900s and
-        # teardown `docker rm` blows its 10s timeout. arm64 (2 CPU → -j4)
-        # passes for exactly this reason.
+        # The test runner auto-caps workers for tests/docker (the suite is
+        # bounded by the single dind dockerd, not CPU — see
+        # run_tests_parallel.py's docker-suite auto-cap).
         uses: ./.github/actions/profile
         with:
           label: docker-tests
-          command: HERMES_TEST_WORKERS=4 scripts/run_tests.sh tests/docker/ --file-timeout 600
+          command: scripts/run_tests.sh tests/docker/ --file-timeout 600
 
   # ---------------------------------------------------------------------------
   # Rebuild and push each architecture only after the unprivileged build/test

scripts/run_tests_parallel.py

@@ -967,6 +967,27 @@ def main() -> int:
         test_counts = {f: test_counts[f] for f in files if f in test_counts}
         approx_total_tests = sum(test_counts.values())
 
+    # Docker-suite auto-cap: tests/docker files all funnel through a single
+    # docker daemon, so parallel width is bounded by dockerd, not CPU.
+    # Running the suite at cpu*2 width thrashes the daemon (files stretch
+    # from ~100s to ~900s, teardown `docker rm` blows its timeout). Cap at
+    # 4 unless the user explicitly chose a width (-j or HERMES_TEST_WORKERS).
+    _DOCKERD_BOUND_JOBS = 4
+    jobs_explicit = (
+        os.environ.get("HERMES_TEST_WORKERS")
+        or any(a == "-j" or a.startswith(("--jobs", "-j")) for a in sys.argv[1:])
+    )
+    if not jobs_explicit and files and all(
+        "tests/docker/" in str(f).replace(os.sep, "/") for f in files
+    ):
+        if args.jobs > _DOCKERD_BOUND_JOBS:
+            print(
+                f"Docker suite detected (single dockerd bottleneck): "
+                f"capping workers {args.jobs} -> {_DOCKERD_BOUND_JOBS}",
+                flush=True,
+            )
+            args.jobs = _DOCKERD_BOUND_JOBS
+
     if roots:
         roots_str = [str(r.relative_to(repo_root)) if r.is_relative_to(repo_root) else str(r) for r in roots]
         print(