fix(kanban): add dispatcher preflight guards

[AleksandrovVladimir]

Adds real dispatcher preflight guards before worker spawn:

• refuse missing assignee profiles before subprocess spawn
• refuse selection-packet/planning artifacts
• refuse duplicate running workspace writers
• add optional strict mode (HERMES_KANBAN_STRICT_DISPATCH_PREFLIGHT=1 or kanban.strict_dispatch_preflight) for workspace existence/worktree checks and CAT-style task contract fields
• expose preflight_blocked in hermes kanban dispatch --json and daemon logs

Verification:

• python3 -m py_compile hermes_cli/kanban_db.py hermes_cli/kanban.py
• python3 -m pytest -q tests/hermes_cli/test_kanban_db.py -q
• python3 -m pytest -q tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_cli.py -q
• CAT live read-only snapshot: dispatch preflight PASS with 0 runnable tasks
• CAT dispatch dry-run: no spawned tasks, no preflight blocks

Note: this branch is stacked on existing fix/kanban-worker-race work already present in the local checkout; this commit is the preflight guard increment.

[AleksandrovVladimir]

Closed in favor of clean non-stacked PR for the dispatcher preflight guard.