docs(kanban): RFC task-scoped skill injection

[hehehe0803]

Summary

• Adds an RFC/developer-guide page for Kanban task-scoped read-only skill injection.
• Defines how required task.skills should preflight against profile-local roots plus approved read-only task overlay roots.
• Specifies resolver precedence/collision behavior, provenance/audit events, and future optional_skills semantics.
• Keeps the design upstream-generic: no dependency on local Hermes OS overlay/profile-sync scripts.

Relationship to existing work

• Builds on issue Kanban: task-scoped read-only skill overlays and orchestrator skill catalog #33245.
• Compares against fix(kanban): sync allowlisted forced skills before blocking #33640's current crash-loop protection model: fix(kanban): sync allowlisted forced skills before blocking #33640 can remain the narrow fail-closed preflight/sync fix, while this RFC defines the non-mutating long-term availability model.

Test plan

• cd website && npm run build
  • Build succeeded.
  • Existing Docusaurus warnings remain for unrelated broken links/anchors in web-dashboard and zh-Hans docs; no new failure from this RFC page.

[teknium1]

Thanks for documenting the broader overlay design. The RFC remains useful, but its baseline needs an update before it can serve as a reliable developer guide.

Problems

• website/docs/developer-guide/kanban-task-scoped-skill-injection.md:46 and :171 describe a spawned --skills kanban-worker. Current dispatch forwards only declared task skills (hermes_cli/kanban_db.py:8031-8039); the current regression test explicitly says no skill is auto-loaded (tests/hermes_cli/test_kanban_core_functionality.py:3043-3079).
• website/docs/developer-guide/kanban-task-scoped-skill-injection.md:48 says missing required skills fail at startup. Current CLI skips missing names when at least one requested skill loads, and raises only when all are missing (cli.py:15931-15947).

Suggested changes

• Refresh the current-state comparison and label fail-closed handling as proposed RFC behavior, not current behavior.

Automated hermes-sweeper review.

[teknium1]

This is stale against current main: _default_spawn() forwards only task.skills (hermes_cli/kanban_db.py:8031-8039), and tests/hermes_cli/test_kanban_core_functionality.py:3043-3079 explicitly asserts no skill is auto-loaded. Please remove kanban-worker from the current-state command and explain that lifecycle guidance is injected separately.