feat(kanban): add failure rollups and dispatcher caps

[ACR27]

Summary

• add machine-readable Kanban failure classification taxonomy and expose rollups through CLI/API/dashboard data
• add conservative stale-worker diagnostic classification and tests
• add per-assignee Kanban dispatcher caps via config and CLI overrides while preserving global max_spawn
• plumb per-assignee caps through the gateway embedded dispatcher

Test Plan

• env -u HERMES_KANBAN_DB -u HERMES_KANBAN_HOME -u HERMES_KANBAN_WORKSPACES_ROOT -u HERMES_KANBAN_BOARD -u HERMES_KANBAN_TASK -u HERMES_KANBAN_RUN_ID python -m pytest tests/hermes_cli/test_kanban_diagnostics.py tests/plugins/test_kanban_dashboard_plugin.py tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_core_functionality.py -q -o addopts=''
• Result after latest rebase: 323 passed, 1 skipped

Review Notes

• Independent review passed with no blocking security or logic findings.
• Addressed reviewer suggestions by tightening broad classifier substrings and making dry-run respect global max_spawn.

[teknium1]

Thanks @ACR27 — closing this one. The hardening feature (702 LOC, 10 files) overlaps with recent dispatcher work landed in parallel salvages this week: max_in_progress (#28420), respawn guard (#28455), stale detection (#28452), corrupt-board quiet (#28439). Failure rollups specifically may still have a place — but the dispatcher cap concept is now landed. If you want to revisit the rollup observability piece against current main, a focused fresh PR would be the right shape. Appreciate the work.