fix: refactor run tools parallel to class

[hwixley]

Context

What

Have you written unit tests?

• Yes
• No (add why you have not)

Are there any specific instructions on how to test this change?

• Yes (if so provide more detail)
• No

Relevant links

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

[github-actions]

⚠️ Python Vulnerabilities detected: 22 unique issues.

High:

• CVE-2026-25673 (fix: 4.2.29, 5.2.12, 6.0.3, severity: HIGH, GHSA: GHSA-8p8v-wh79-9r56)
• CVE-2026-32597 (fix: 2.12.0, severity: HIGH, GHSA: GHSA-752w-5fwx-jx9f)
• CVE-2026-31958 (fix: 6.5.5, severity: HIGH, GHSA: GHSA-qjxf-f2mg-c6mc)
• CVE-2025-64439 (fix: 3.0.0, severity: HIGH, GHSA: GHSA-wwqv-p2pp-99h5)
• CVE-2025-30167 (fix: 5.8.1, severity: HIGH, GHSA: GHSA-33p9-3p43-82vq)
• CVE-2025-67221 (fix: 3.11.6, severity: HIGH, GHSA: GHSA-hx9q-6w63-j58v)

Moderate:

• CVE-2025-69872 (fix: , severity: MODERATE, GHSA: GHSA-w8v5-vhqr-4h9v)
• GHSA-78cv-mqj4-43f7 (fix: 6.5.5, severity: MODERATE)
• CVE-2026-28277 (fix: 1.0.10, severity: MODERATE, GHSA: GHSA-g48c-2wqr-h844)
• CVE-2026-27794 (fix: 4.0.0, severity: MODERATE, GHSA: GHSA-mhr3-j7m5-c7c9)

Low:

• CVE-2026-25674 (fix: 4.2.29, 5.2.12, 6.0.3, severity: LOW, GHSA: GHSA-mjgh-79qc-68w3)
• CVE-2026-26013 (fix: 1.2.11, severity: LOW, GHSA: GHSA-2g6r-c272-w58r)

Unknown (to be checked):

• CVE-2026-27962 (fix: 1.6.9, severity: UNKNOWN)
• CVE-2026-28490 (fix: 1.6.9, severity: UNKNOWN)
• CVE-2026-4539 (fix: , severity: UNKNOWN)
• CVE-2026-25645 (fix: 2.33.0, severity: UNKNOWN)
• CVE-2026-26209 (fix: 5.9.0, severity: UNKNOWN)
• CVE-2026-30922 (fix: 0.6.3, severity: UNKNOWN)
• CVE-2026-27448 (fix: 26.0.0, severity: UNKNOWN)
• CVE-2026-27459 (fix: 26.0.0, severity: UNKNOWN)
• CVE-2026-32874 (fix: 5.12.0, severity: UNKNOWN)
• CVE-2026-32875 (fix: 5.12.0, severity: UNKNOWN)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 93.54839% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.42%. Comparing base (de12849) to head (62453ca).

Files with missing lines	Patch %	Lines
redbox/redbox/graph/nodes/runner/runner.py	91.30%	10 Missing ⚠️
redbox/redbox/graph/nodes/runner/wrap_async.py	96.15%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #931      +/-   ##
==========================================
- Coverage   81.99%   81.42%   -0.58%     
==========================================
  Files         199      202       +3     
  Lines        8226     8338     +112     
==========================================
+ Hits         6745     6789      +44     
- Misses       1481     1549      +68     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 62453ca.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None