fix(kanban): preflight missing Codex profile auth

[cirwel]

Summary

• Add a Kanban worker spawn preflight for assignee profiles configured with model.provider: openai-codex but missing a profile-local auth.json.
• Fail before subprocess.Popen with a non-secret diagnostic that points operators to intentional profile auth setup via hermes -p <profile> auth or hermes -p <profile> model.
• Cover both missing-store and present-store behavior in Kanban DB tests.

Why

While dogfooding Kanban with a cloned worker profile, the profile copied config that selected OpenAI Codex but did not carry OAuth auth state. The dispatcher could still spawn the worker, which then exited immediately with the existing Codex credential error. This catches the obvious missing-profile-store case before process launch without reading, printing, or copying credential contents.

Test plan

• python3 -m pytest tests/hermes_cli/test_kanban_db.py -q
• python3 -m compileall -q hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_db.py
• git diff --check

[cirwel]

Superseded by #20706 — thanks!