fix: add privileged post-review kanban reconciliation

[2seok2]

Summary

• Add an evidence-gated reconcile_post_review_closure DB helper for approved+merged post-review lanes.
• Add hermes kanban reconcile-post-review as a privileged unscoped runner/orchestrator CLI path; dispatcher-scoped workers cannot use it unless trusted runner code explicitly opts in.
• Document the closure protocol in the bundled kanban-worker skill.

Validation

• python -m pytest tests/hermes_cli/test_kanban_db.py tests/tools/test_kanban_tools.py -q -o 'addopts=' (298 passed, 1 warning)
• python -m compileall -q hermes_cli/kanban.py hermes_cli/kanban_db.py
• Read-only lineage check for web-archive tasks t_38969b18 / t_357a83e4 / t_be51753e confirmed original/review/closure done, approved metadata, and PR fix(security): prevent shell injection in sudo password piping #65 merged summary evidence.

Safety

• Keeps existing worker cross-task mutation guard intact.
• New reconciliation path requires explicit review_approved=true and pr_merged=true evidence plus completed reviewer metadata approved=true for the original task.

[2seok2]

Superseded by local Hermes ops overlay patch per user direction: do not touch official hermes-agent files for this incident. Closing this upstream PR path instead of pursuing maintainer-gated merge.