fix: keep blocked kanban tasks blocked

[janishohbergs85-star]

Summary

• Prevent recompute_ready() from auto-promoting status='blocked' Kanban tasks.
• Add regressions for no-parent blocked approval gates, blocked children with done parents, dispatcher claim/spawn behavior, circuit-breaker blocked state, and explicit unblock.
• Keeps blocked tasks as a true human/operator gate until explicit unblock.

Test Plan

• python -m pytest tests/hermes_cli/test_kanban_blocked_sticky.py tests/hermes_cli/test_kanban_db.py -q -o 'addopts=' — 180 passed
• Kanban final verifier evidence from Janis runtime: t_6eed0ef4 GREEN after gateway reload; blocked tasks did not promote/claim/spawn.

[teknium1]

Thanks for the focused regression coverage. The worker/operator handoff loop described here is already addressed on current main by commit 34120a0ae20ae3fc23eeb304efd750e2d2c83c87 (fix(kanban): worker-initiated block must not be auto-promoted (#28712)).

Problems

• The proposed recompute_ready change treats every blocked task as a human gate. Current main deliberately distinguishes worker/operator blocks from circuit-breaker blocks in hermes_cli/kanban_db.py:3244-3279; only the former are sticky at hermes_cli/kanban_db.py:3324-3329.
• Current main retains bounded automatic recovery for non-sticky blocks below the effective failure limit at hermes_cli/kanban_db.py:3337-3358, with direct coverage in tests/hermes_cli/test_kanban_blocked_sticky.py:107-143. The PR reverses that contract.

Suggested changes

• Preserve the source-aware blocked-state behavior. A broader change to make circuit-breaker blocks require manual intervention needs a current-main repro and an explicit redesign of the failure-limit recovery semantics.

Automated hermes-sweeper review.