Add Claude CLI runtime and Kanban auth preflight

[stefan-wisbric]

Summary

• add a Claude CLI runtime path so Hermes profiles can use Claude Code subscription auth
• preflight Claude CLI-backed Kanban assignees before claiming ready or review tasks, including a tiny inference smoke test to catch stale subscription tokens that still pass auth status
• leave tasks retryable and emit a spawn_preflight_failed event when Claude CLI auth is logged out or unhealthy
• route code-review handoffs through review child tasks instead of sticky-blocking implementation tasks
• skip force-loaded worker skills that are not installed in the target profile so review dispatch does not crash on missing sdlc-review

Why

Claude CLI auth is managed by Claude Code, separately from Hermes provider auth and Codex app-server auth. When the local Claude CLI token goes stale, Kanban workers currently claim the task and then block it with a 401 external-runtime-prose failure. Also, implementation workers were instructed to block with review-required, which can deadlock graphs where a review child waits for the implementation parent. This keeps unhealthy Claude CLI profiles unclaimed, makes review children the explicit gate, and avoids worker startup crashes from missing profile-local skills.

Verification

• /Users/stefans/git/hermes-agent/venv/bin/python -m ruff check agent/prompt_builder.py tools/kanban_tools.py hermes_cli/kanban_db.py tests/tools/test_kanban_tools.py tests/hermes_cli/test_kanban_core_functionality.py tests/hermes_cli/test_kanban_db.py
• /Users/stefans/git/hermes-agent/venv/bin/python -m pytest tests/hermes_cli/test_kanban_core_functionality.py::test_default_spawn_skips_unavailable_per_task_skills tests/hermes_cli/test_kanban_core_functionality.py::test_default_spawn_appends_per_task_skills tests/hermes_cli/test_kanban_core_functionality.py::test_default_spawn_dedupes_kanban_worker_from_task_skills tests/hermes_cli/test_kanban_db.py::test_claude_cli_auth_preflight_parses_logged_out_json tests/hermes_cli/test_kanban_db.py::test_claude_cli_auth_preflight_smoke_catches_invalid_credentials tests/hermes_cli/test_kanban_db.py::test_claude_cli_auth_preflight_smoke_passes_when_inference_works tests/tools/test_kanban_tools.py tests/hermes_cli/test_kanban_blocked_sticky.py tests/hermes_cli/test_kanban_db.py tests/agent/transports/test_claude_cli_session.py tests/run_agent/test_claude_cli_integration.py tests/hermes_cli/test_status.py -q
• Host check: claude auth status reports loggedIn true / claude.ai / max, while claude -p smoke currently returns 401; this PR now catches that before claiming Kanban work

[alt-glitch]

Supersedes #27787 (same Claude CLI runtime feature, with additional Kanban auth preflight). Same core file changes plus kanban_db.py additions.

[stefan-wisbric]

Closing for now. The Claude CLI subscription runtime is maintained on our fork (https://github.com/stefan-wisbric/hermes-agent). We've since moved the auth preflight out of Hermes core into a thin external wrapper so it survives upgrades, so this PR's in-core preflight no longer matches our setup. Glad to re-propose a current, reconciled version if upstream is interested in a logged-in-Claude-CLI runtime.