fix: require successful tool evidence before Kanban completion

[benperry6]

Follow-up to NousResearch#32940 and issue NousResearch#32746, built directly on this branch.

This changes Kanban completion proof from tool-call intent to successful material execution evidence:

• records a metadata-only, current-run receipt in task_events;
• covers native Hermes tools, Codex app-server tools, and MCP business-error responses;
• uses a bounded wait for cross-process receipt visibility;
• rejects completion without qualifying evidence, leaves the task running, and records a protocol_violation event.

Verification:

• 19 targeted Kanban tests passed;
• 24 Codex projector tests passed;
• 58 Codex app-server session tests passed;
• Ruff, py_compile, and git diff --check passed;
• independent code review: PASS.

The separate product decision about a reasoning-only/no-tool exception remains intentionally with maintainers.

Cherry-pick alternative: e19ff6c499f0b9832f05af127254c28cc333cf8d.

[benperry6]

Superseded by a fresh, standalone current-main commit:

benperry6@5de30d1

The refreshed implementation is based on upstream 1bbb6e5bce56e721ab685af4cd87df21bbff4d35 and avoids asking this older author branch to absorb unrelated mainline history. Closing this follow-up to keep one current implementation reference.