fix(ci): cap docker-suite workers at 4 — the suite is dockerd-bound

Diagnosis from the profiler + runner logs: with the cgroup-aware
default (-j 16 on the 8-CPU pods) all 25 files run concurrently against
the single dind daemon. Every file stretches to ~900s wall (P50 892s,
CPU-wall 14549s vs 918s wall) and teardown docker-rm calls exceed their
10s timeout — the job dies on teardown errors while tests themselves
pass 53/53. The arm64 lane (2 CPU → -j 4) went green for exactly this
reason. Pin the amd64 lane to the same effective width.

.github/workflows/docker.yml

@@ -119,10 +119,15 @@ jobs:
           command: uv sync --locked --python 3.11 --extra dev
 
       - name: Run docker integration tests
+        # HERMES_TEST_WORKERS=4: this suite shares ONE dockerd — parallel
+        # width is bounded by the daemon, not CPU. At cpu*2 workers (16 on
+        # the 8-CPU ARC pods) dockerd thrashes: every file takes ~900s and
+        # teardown `docker rm` blows its 10s timeout. arm64 (2 CPU → -j4)
+        # passes for exactly this reason.
         uses: ./.github/actions/profile
         with:
           label: docker-tests
-          command: scripts/run_tests.sh tests/docker/ --file-timeout 600
+          command: HERMES_TEST_WORKERS=4 scripts/run_tests.sh tests/docker/ --file-timeout 600
 
   # ---------------------------------------------------------------------------
   # Rebuild and push each architecture only after the unprivileged build/test