fix(kanban): resolve worker skill probe against platform default home

[Dusk1e]

What & why

_kanban_worker_skill_available() decides whether the kanban dispatcher
injects --skills kanban-worker into a spawned worker. When the probe is
called with hermes_home=None, it fell back to a hardcoded
Path.home() / ".hermes":

base = _Path(hermes_home) if hermes_home else (_Path.home() / ".hermes")

This is wrong on native Windows, where the canonical Hermes home is
%LOCALAPPDATA%\hermes (see hermes_constants._get_platform_default_hermes_home),
not %USERPROFILE%\.hermes (an empty husk). It also violates the hardline
rule against hardcoding Path.home() / ".hermes" (AGENTS.md → Rules for
profile-safe code #1; Known Pitfalls → DO NOT hardcode ~/.hermes paths).

Reachability: the None branch is hit when _default_spawn() calls
resolve_profile_env() for a non-existent named profile (raises
FileNotFoundError, so HERMES_HOME is never written to the child env —
kanban_db.py:6652-6659) and the dispatcher process itself has no
HERMES_HOME in its environment. env.get("HERMES_HOME") is then None
and the probe scans the wrong directory.

Impact: on native Windows the bundled skill lives under
%LOCALAPPDATA%\hermes\skills\devops\kanban-worker\, but the probe looked
under %USERPROFILE%\.hermes\skills\… → returns False →
--skills kanban-worker is silently dropped, so dispatched workers lose the
pattern library (silent graceful-degradation regression).

Fix

Replace the hardcoded fallback with get_default_hermes_root() — the same
platform-aware helper this module already uses in kanban_home() and at
kanban_db.py:7480. When HERMES_HOME is unset (the precondition for the
None branch), it returns the platform-native default root, matching what
the worker actually resolves. It is also side-effect-free (no warning
emission, unlike get_hermes_home()).

from hermes_constants import get_default_hermes_root
base = _Path(hermes_home) if hermes_home else get_default_hermes_root()

The misleading inline comment (which claimed the fallback is ~/.hermes)
is updated to state the platform-native behavior.

How to test

scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py -k worker_skill_probe

Adds 4 regression tests in tests/hermes_cli/test_kanban_db.py:

• test_worker_skill_probe_resolves_platform_default_on_windows — with
  HERMES_HOME unset on simulated win32, the skill under
  %LOCALAPPDATA%\hermes resolves (True). Fails on the old code (it
  scanned the empty ~/.hermes husk).
• test_worker_skill_probe_ignores_posix_husk_on_windows — a skill present
  only in ~/.hermes is not consulted on win32 (False).
• test_worker_skill_probe_resolves_posix_default_when_home_unset — POSIX
  fallback still resolves ~/.hermes (True).
• test_worker_skill_probe_honors_explicit_home — an explicit hermes_home
  is scanned directly, independent of platform.

The existing integration test test_default_spawn_auto_loads_kanban_worker_skill
still passes.

Platforms tested

test_default_spawn_auto_loads_kanban_worker_skill pass; ruff check
clean. (Other pre-existing failures in the suite on native Windows are
unrelated POSIX-only tests — os.symlink privilege, os.waitpid zombie
reaping, _resolve_hermes_argv shim resolution.)

• Behavior on Linux/macOS is unchanged: the fallback still resolves
  ~/.hermes.

Related

• Follows the profile-safe path rule and the cross-platform HERMES_HOME
  resolution established in [Bug]: get_hermes_home() silently falls back to ~/.hermes in profile mode and causes cross-profile data corruption #18594 / fix: replace hardcoded ~/.hermes paths with get_hermes_home() for profile support #3575.

[teknium1]

Thanks for the focused Windows/profile-home regression analysis.

Automated hermes-sweeper review found that current main already supersedes this path:

• Commit 84e1d31e5442eeff0bfcf1c2ffab6acf7fe95f45 removed _kanban_worker_skill_available() and the automatic --skills kanban-worker injection from hermes_cli/kanban_db.py.
• agent/prompt_builder.py:189 now provides the Kanban lifecycle/reference material through KANBAN_GUIDANCE for every worker, independent of profile skill lookup.
• hermes_cli/kanban_db.py:8031 now adds --skills only for explicitly requested task skills; the Windows fallback probe targeted here no longer exists.
• tests/hermes_cli/test_kanban_core_functionality.py:2768 covers the replacement guarantee by asserting no bundled skill is auto-loaded.

Closing as implemented on main.