fix: pin tools from a called flow's own vars

[piekstra]

Tool profile env pins were computed once per run from the top-level flow's vars. A suite has no vars of its own, so its members ran their tools without the tenant or account their own vars named, while the same flow run alone worked. A profile that read vars.tenant without a has() guard failed the whole suite before any member started.

• A flow called by a flow step pins the tools it lists from its own vars, over its caller's pins. A nested flow that does not list the tool keeps its caller's pins.
• At the top level, a pin that cannot be resolved for a tool only callees list is left unset instead of failing the run. Tools the top-level flow lists still fail on an unresolvable pin.
• A called flow's services get that flow's pins.
• Preflight still checks each tool once, with the top-level pins. The docs say this under Tools.

Test: a_called_flow_pins_tools_from_its_own_vars runs a suite with an unguarded vars.tenant pin, a member that pins it from its environment, and a nested flow that inherits it.

[piekstra]

Review fixes: a pin the top-level flow cannot resolve for a tool only its callees list is left unset instead of failing the run; called flows' services get that flow's pins; the test covers an unguarded vars pin and a nested flow; docs state that preflight checks with the top-level pins.