fix(kanban): reject late-link after child start

[crayfish-ai]

Summary

• reject linking an unfinished parent onto a child that has already started or reached a terminal state
• keep the ready-to-todo demotion path, but emit a depromoted event before linked for auditability
• add regression coverage for running and blocked children plus the depromoted event sequence

Testing

• source .venv/bin/activate && pytest tests/hermes_cli/test_kanban_db.py -x -q -k not\ resolve_hermes_argv