chore(kanban): batch salvage — metadata test, max_spawn config, run-id lifecycle guard (salvages #19522 #19556 #19829)

[teknium1]

Batched salvage of three tier-1 kanban PRs — all narrow, well-tested, and non-overlapping.

What each commit does

#19522 (@Fearvox) — test(kanban): cover metadata handoff round-trip

• Adds a test that creates a task, completes it with structured metadata, then reads it back via kanban_show to assert the metadata round-trips through the DB without mutation.
• One file, 27 lines. Pure test.
• Minor adjustment: updated stale assertion to match current "Kanban task execution protocol" header text.

#19556 (@momowind) — feat(gateway): respect kanban.max_spawn config

• The gateway dispatcher was calling dispatch_once(conn) without forwarding the max_spawn kwarg that dispatch_once already accepted — so kanban.max_spawn in config.yaml had no effect.
• Six-line fix: reads kanban_cfg["max_spawn"] and threads it through to dispatch_once(conn, board=slug, max_spawn=max_spawn).
• Minor adjustment: preserved the board=slug kwarg that landed in a subsequent multi-project-boards merge (salvage needed the two kwargs together).

#19829 (@misery-hl) — guard kanban worker lifecycle by run id

• Real correctness fix: if an operator reclaims + reassigns a task mid-run, the zombie worker's delayed kanban_complete / kanban_block / kanban_heartbeat calls can silently mutate state for a task that's already been transferred to a new run. This adds an expected_run_id guard to complete_task, block_task, and heartbeat_worker so stale workers get rejected.
• New helper _worker_run_id(task_id) reads HERMES_KANBAN_RUN_ID from the worker's env, threaded through at spawn time.
• 243/36 across 5 files. Includes regression tests for retry-after-unblock and retry-after-timeout.
• Authorship: commit was authored by clockwork-codex@users.noreply.github.com (a bot account). Re-authored during salvage to misery-hl@users.noreply.github.com to credit the actual PR author.

Merge conflict resolutions

• tests/tools/test_kanban_tools.py in test(kanban): assert metadata handoff round-trip #19522: kept current-main header phrasing ("identity-free — SOUL.md owns identity, layer 3 is protocol") over the PR's stale "# Kanban task execution protocol".
• gateway/run.py in feat(gateway): respect kanban.max_spawn config #19556: combined the PR's max_spawn=max_spawn with current main's board=slug kwarg.
• hermes_cli/kanban_db.py in [codex] Guard Kanban worker lifecycle by run id #19829: kept both created_cards (hallucination gate, recently merged) and expected_run_id (this PR) on complete_task.
• tools/kanban_tools.py in [codex] Guard Kanban worker lifecycle by run id #19829: kept the hallucination-gate try/except kb.HallucinatedCardsError wrapper AND added expected_run_id=_worker_run_id(tid) to the complete_task call.

Validation

	Result
Full kanban test suite	393/393 pass (+4 net from these PRs)
Syntax check	all files compile
Attribution	3 commits, 3 contributors preserved
AUTHOR_MAP	entries added for momowind + misery-hl

Closes #19522. Closes #19556. Closes #19829.

Co-authored-by: 0xVox 35294173+Fearvox@users.noreply.github.com
Co-authored-by: Moonyeah momowind@gmail.com
Co-authored-by: misery-hl 207811921+misery-hl@users.noreply.github.com