feat: add Kanban runtime preflight guardrails

[fcampogni2012]

Summary

• Add default runtime guardrails to Kanban decomposed child tasks.
• Add hermes runtime preflight --scope kanban for executable Kanban safety checks.
• Expose the Kanban runtime preflight contract to dispatched worker environments.

Test Plan

• venv/bin/python -m pytest tests/hermes_cli/test_ops_reports.py tests/hermes_cli/test_kanban_db.py::TestSharedBoardPaths::test_dispatcher_spawn_injects_kanban_db_and_workspaces_root tests/hermes_cli/test_runtime_preflight.py tests/hermes_cli/test_kanban_decompose.py -q — 17 passed
• venv/bin/python -m pytest tests/hermes_cli/test_ops_reports.py tests/hermes_cli/test_runtime_preflight.py tests/hermes_cli/test_kanban_decompose.py tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_cli.py tests/hermes_cli/test_cmd_update.py -q — 230 passed

Notes

• This PR intentionally excludes local/private ops-report dogfood work.

[teknium1]

Thanks for the Kanban safety work. The premise still exists on current main: origin/main has no hermes runtime preflight --scope kanban, no runtime_guardrails config, and hermes_cli/kanban_decompose.py:436 still stores child bodies as body.strip().

Problems

• hermes_cli/runtime_preflight.py:21 only accepts model.default / model.name; existing config compatibility also recognizes model.model (hermes_cli/kanban_diagnostics.py:253-263), so valid configs can fail preflight.
• hermes_cli/runtime_preflight.py:27 reads root-level config.provider before model.provider, but current provider selection uses model.provider (hermes_cli/main.py:2677-2686) and the provider setup path writes model.provider (hermes_cli/auth.py:6257-6293). A stale root key could produce a false PASS.
• The dispatcher adds HERMES_RUNTIME_PREFLIGHT_SCOPE / HERMES_RUNTIME_PREFLIGHT_REQUIRED, but the new preflight module does not read those env vars, so the worker-launch contract is exposed but not asserted.

Suggested changes

• Reuse or mirror the existing model/provider resolution shape, including model.model compatibility.
• Either validate the preflight env contract in collect_kanban_preflight() or drop the contract vars/comments until they have an enforcement path.

Automated hermes-sweeper review.

[teknium1]

This should also consider model_cfg.get("model"): existing config compatibility treats model.model as a valid backcompat key, so this preflight can false-fail configs the runtime accepts.

[teknium1]

Root-level provider is not the current runtime selection source; provider setup writes model.provider, and trusting a stale root key here can turn a missing runtime provider into a false PASS.

[teknium1]

If this env var is meant to prove the worker was launched through the dispatcher, collect_kanban_preflight() should read and validate it; otherwise the contract is only informational despite the guardrail wording.

[alt-glitch]

Related: #28642 (dispatcher preflight guards), #33747 (preflight kanban skills before spawning). This PR adds a new hermes runtime preflight --scope kanban CLI surface + runtime_preflight.py module that the other cluster PRs lack — different mechanism, not a duplicate.