fix(kanban): report blocking parents from kanban_complete tool, state delegate handoff contract

[JoaoMarcos44]

Summary

Fixes the worker-facing half of #113373. A dispatcher-owned worker that finishes genuinely-done work while a parent is unfinished (reopened mid-run) calls the kanban_complete tool — the surface workers actually use — and gets could not complete t_x (unknown id, stale run, or already terminal). The real refusal is unsatisfied parents, so the worker/operator chases stale runs, the run burns, crashes, re-queues, and repeats deterministic work (rewriting artefacts other lanes read).

• tools/kanban_tools.py — new read-only _unsatisfied_parent_blockers() (same task_links join as kanban_db._parents_satisfied, deterministic ORDER BY p.id). _handle_complete now reports could not complete t_x: unsatisfied parent dependencies: t_p (todo); complete the parents first (done or archived) when blockers exist. Unknown-id and terminal refusals keep the generic text; the dependency invariant is untouched (no force path); the lookup is advisory reporting after the authoritative write, and the task stays running for a retry.
• tools/delegate_tool.py — spawn-time surfacing (Kanban worker in delegate_task child context cannot close its own card, then the run dies — completed work is unrecordable and the card re-runs #113373 ask 1): one RULES line in the delegate_task description (Children cannot close tracked work: ... the parent applies the transition), so a delegated card no longer burns a full run before learning it can never close. Generic vocabulary, no cross-toolset names; description stays under the 2200-char ceiling (2191).
• tests/tools/test_kanban_complete_parents_tool.py (new, 6 tests) — parents named + task still running, deterministic multi-parent order, unknown-id/terminal stay generic, happy path unchanged, description contract.

Relationship to existing PRs (not a duplicate)

• fix(kanban): report blocking parents when refusing kanban complete #110323 / fix(kanban): report completion refusal reasons #110330 / fix(kanban): report blocking parents when complete refuses #110334 fix the same refusal class on the CLI surface (hermes kanban complete via hermes_cli/kanban_db.py + hermes_cli/kanban.py). This PR touches neither file — it is the complementary tool surface, which is what the dispatched worker in Kanban worker in delegate_task child context cannot close its own card, then the run dies — completed work is unrecordable and the card re-runs #113373 actually called. No file overlap, no supersede.
• Delegate-isolation PRs (fix(kanban): restrict automatic heartbeats to the dispatcher owner #74583, fix(kanban): isolate delegated child lifecycle handoffs #103328, fix(kanban): a delegated child must not heartbeat the parent worker's card #113314, fix(kanban): fail the delegate-child write fence closed when the delegation context is un-evaluable #109867) harden the child-mutation fence; this PR preserves that fence (delegate children are still rejected before any DB access) and only documents the handoff contract at spawn time.
• No operator force-complete path is added: after a crash the card returns to ready/review and kanban_complete already accepts it there — the parents gate that blocked Kanban worker in delegate_task child context cannot close its own card, then the run dies — completed work is unrecordable and the card re-runs #113373's operator is correct DAG semantics, now reported actionably.

Root-cause evidence

Reproduced on main at 8a25cb9 and re-verified after rebasing onto current main (4716ec0, head ac8c8d1): parent done -> child claimed (running) -> parent reopened (todo) -> worker's _handle_complete returned could not complete t_6d9a0938 (unknown id, stale run, or already terminal) before the fix, and could not complete t_x: unsatisfied parent dependencies: t_p (todo); ... after.

RED proof (single-file revert, no stash): with only tools/kanban_tools.py reverted, test_complete_names_unsatisfied_parent + test_complete_multiple_parents_deterministic_order fail with the verbatim pre-fix message and the other 4 pass; with only tools/delegate_tool.py reverted, the description contract test fails and the rest pass.

Test plan

• scripts/run_tests.sh tests/tools/test_kanban_complete_parents_tool.py — 6 passed (also green after the rebase onto 4716ec0)
• scripts/run_tests.sh tests/tools/test_kanban_complete_parents_tool.py tests/tools/test_kanban_tools.py — 44 passed
• scripts/run_tests.sh tests/tools/test_delegate.py tests/tools/test_delegate_kanban_isolation.py — 87 passed
• python -m compileall on touched files — clean; git diff --check — clean

Limitations

• The live card t_aeaf817e from the issue lives on the reporter's board and could not be inspected from here; verification is via the deterministic timeline reproduction above.
• request_review already surfaces its parents reason (with_reason=True); kanban_block has no parents gate (blocking is always allowed) — kanban_complete was the only masking sibling.

Closes #113373

[teknium1]

Thanks @JoaoMarcos44. Your change was salvaged into #114786 with your authorship preserved (cherry-picked); #114786 — fix(kanban): kanban_link refuses a running child and dependency refusals name the open parents (#113374, #113373, salvage #113398, #113452) — is now merged on main at e6a8eb7f95aa, closing issues #113374, #113373. Closing this PR in favour of the landed change; if you see a case it does not cover, please open a fresh issue with the repro and tag it.