fix(workflows): propagate run cancellation into sub_workflow children (#675)

src/workflows/caps/mod.rs

@@ -293,6 +293,15 @@ pub async fn build_capabilities(
         state,
         resolver,
         agent,
+        // New in tinyflows 0.6.1, pinned here via the #675 cancel-token chain
+        // (openhuman #5520 → tinyflows #31). A `shell` node runs an inline
+        // POSIX script through a host-configured runner; OC wires none, and
+        // whether a workflow may spawn shell processes on the company host is a
+        // policy question this repo has not answered. `None` fails such a node
+        // at run time with a capability error — the honest answer until that
+        // decision is made, and no company manifest can currently author a
+        // `shell` node (mirrors `memory` below).
+        shell: None,
         // New in tinyflows 0.6, which arrived with the #499 pin bump. Left
         // unwired deliberately rather than pointed at the company's context
         // store: a `memory` node would then read and WRITE agent memory on

src/workflows/gate.rs

@@ -357,13 +357,15 @@ fn call_of(node: &tinyflows::model::Node) -> Option<(String, Value, Option<Strin
         // Runs a turn. Its gated calls already park through #395's drain, so
         // gating here would park the same call twice.
         NodeKind::Agent
-        // Capabilities that are explicit stubs today: `CodeRunner` and
-        // `MemoryProvider` are wired to error / left `None` (see `caps`), so
-        // there is no call to classify. **These are the next two to gate** —
-        // sandboxed code and a memory *write* are both effectful — and the
+        // Capabilities that are explicit stubs today: `CodeRunner`,
+        // `MemoryProvider`, and the `ShellRunner` (new in tinyflows 0.6.1) are
+        // wired to error / left `None` (see `caps`), so there is no call to
+        // classify. **These are the next three to gate** — sandboxed code, a
+        // memory *write*, and a shell script are all effectful — and the
         // decision belongs with whoever wires the capability, in the same PR.
         | NodeKind::Code
         | NodeKind::Memory
+        | NodeKind::Shell
         // A child graph is resolved and run *inside* the engine
         // (`run_sub_workflow`), so its nodes never pass this function at all —
         // this arm is not what excludes them. The module docs give the reason