fix(kanban): preflight Codex worker auth readiness

[mg-mister]

Summary

• let profile-local broken Codex auth fall back to valid root/global Hermes auth without copying refresh tokens into worker profiles
• add a narrow Kanban pre-spawn readiness gate for deterministic Codex auth failures, including immediate block for no-fallback auth failures
• preserve configured runtime fallback providers and ACPX canonical-home routing for profile workers

Test plan

• python -m py_compile hermes_cli/auth.py hermes_cli/kanban_db.py
• scripts/run_tests.sh tests/hermes_cli/test_auth_codex_provider.py tests/hermes_cli/test_auth_profile_fallback.py tests/hermes_cli/test_kanban_db.py

Notes

• The readiness probe uses refresh_if_expiring=False so it does not consume Codex refresh tokens during preflight.
• Refreshes sourced from the global auth store write back to that source store, not to profile-local auth files.

[alt-glitch]

Related to closed #19475 (original Codex profile auth preflight fix) and open #31461 (Claude CLI runtime + Kanban auth preflight). This PR extends the preflight concept with global-root auth fallback — not a direct duplicate since it adds new fallback logic, but overlaps significantly with #31461's auth preflight scope.

[mg-mister]

Thanks — agreed this overlaps with #31461 at the Kanban preflight layer, but the failure mode here is narrower/different:

• Codex OAuth profile-local auth can become invalid/empty and shadow a valid root/global Hermes auth store.
• This PR lets workers use the valid source auth store without copying refresh tokens into profile homes.
• The readiness gate is narrow: it preflights deterministic openai-codex auth failures without consuming refresh tokens, preserves configured runtime fallbacks, and fails open on inconclusive fallback probes.

Local validation on the PR branch:

python -m py_compile hermes_cli/auth.py hermes_cli/kanban_db.py
scripts/run_tests.sh tests/hermes_cli/test_auth_codex_provider.py tests/hermes_cli/test_auth_profile_fallback.py tests/hermes_cli/test_kanban_db.py
# 200 passed, 0 failed

Actions are currently action_required from the fork with no jobs/logs yet, so maintainer approval is needed before CI can run.

[teknium1]

Thanks for identifying the broken-local-Codex-state case. The premise still holds on current main: _load_provider_state_with_source() returns a profile-local provider block before root fallback (hermes_cli/auth.py:1190-1204), and _read_codex_tokens() rejects malformed local tokens (hermes_cli/auth.py:3232-3278).

Problems

• The auth implementation needs a current-head salvage, not a direct application. Current _save_codex_tokens() also synchronizes eligible Codex credential-pool entries (hermes_cli/auth.py:3382-3407), while the current refresh path includes CLI self-healing (hermes_cli/auth.py:3560-3601). Source-aware global writes must preserve both contracts.
• The Kanban dispatcher has moved: ready and review claims now occur at hermes_cli/kanban_db.py:7497 and :7589. Apply the readiness decision consistently to both current loops.

Suggested changes

• Rebuild the source-selection/refresh path against current auth code and add regressions for malformed local state, global-source persistence, pool synchronization, and self-healing.
• Reapply the readiness gate after each current claim and before spawn, retaining current task-run/event semantics.

Automated hermes-sweeper review.