fix(kanban): guard corrupted board DB auto-init (Fixes #30687)

[deepujain]

Summary

Fixes #30687.

Kanban command startup still auto-initializes the DB so fresh installs work, but that same path was unsafe for an existing board whose DB had been truncated or replaced with a schema-less SQLite file. In that case connect() could create the full schema and let commands continue against an empty board.

This change adds a DB-open guard before schema creation:

• existing zero-byte Kanban DBs fail with a clear error instead of being initialized
• existing SQLite files that are missing the required tasks table fail before CREATE TABLE IF NOT EXISTS
• known named boards whose DB path is missing fail during automatic command startup
• hermes kanban init and create_board() pass an explicit allow_recreate flag, so deliberate initialization still works

The check also catches the risky alternate/top-level DB case: an existing current board plus an empty HERMES_KANBAN_DB target no longer becomes a new empty board by accident.

Tests

• scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_boards.py
  • 221 passed
• /Users/dejain/nvidia/oss/hermes-agent/.venv/bin/ruff check hermes_cli/kanban.py hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_boards.py
  • passed

Notes

• Platform tested: macOS local dev environment.
• This does not attempt SQLite page recovery or backups; it only prevents the silent auto-recreation path and leaves explicit recovery/init decisions to the user.

[deepujain]

@teknium1 Updated this PR again against current main and resolved the new hermes_cli/kanban.py conflict by keeping both behaviors: scoped board context from main, plus skipping pre-dispatch auto-init for the explicit kanban init path. GitHub now reports the PR as mergeable. Focused validation: scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_boards.py passed, 273/273. I still cannot formally request review because GitHub says this account lacks RequestReviewsByLogin permission on this repo. Could you approve any pending workflow run and review when you have a chance?

[deepujain]

@teknium1 Follow-up after seven quiet days. This PR still has no visible checks, assignee, requested reviewer, or human review. GitHub reports it as mergeable. Focused validation from the refreshed branch: scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_boards.py passed, 273/273. GitHub still will not let me formally request review from this fork. Could you approve any pending workflow run and review when you have a chance?

[teknium1]

Thanks for addressing a real Kanban data-loss scenario. This is now redundant with the corruption guard already merged on main.

• Current connect() runs _validate_sqlite_header() and _guard_existing_db_is_healthy() before SQLite opens and schema initialization can occur (hermes_cli/kanban_db.py:1739-1748).
• The guard runs PRAGMA integrity_check, preserves malformed database bytes in a backup, and raises KanbanDbCorruptError instead of allowing schema recreation (hermes_cli/kanban_db.py:1624-1679).
• Regression coverage verifies both init_db() and connect() reject a valid-header, malformed-page database without modifying its original bytes (tests/hermes_cli/test_kanban_db.py:4306-4332).
• The implementation was merged via fix(kanban): refuse corrupt db auto-init #30862 in c4b8f5efee8cdd3186e465d940bf0e8c98849346, which is present in current main.

Automated hermes-sweeper review.