fix: auto-subscribe on CLI kanban create + check SendResult in notifier

[hannes-x]

Summary

Two related kanban notification fixes:

1. Auto-subscribe on CLI kanban create

hermes kanban create invoked via CLI did not auto-subscribe the caller. Added auto-subscribe to _cmd_create using get_session_env().

• Added build_session_subprocess_env() in gateway/session_context.py
• Replaced inline ContextVar injection in _make_run_env with new helper
• Added auto-subscribe logic to _cmd_create in hermes_cli/kanban.py

2. Check SendResult.success in notifier

The notifier called adapter.send() but ignored the returned SendResult. Silent failures (thread not found, etc.) were treated as success — the notifier logged 'delivered', removed the subscription, and the user never received notifications.

• Now checks result.success after adapter.send()
• Raises RuntimeError on failure, caught by existing except block for proper rewinding

Test Plan

• hermes kanban create auto-subscribes correctly
• Subscription target matches current thread
• Notifier handles SendResult(success=False) by rewinding instead of deleting subscription

[liuhao1024]

Verification review — reviewed the diff across all 4 files.

gateway/kanban_watchers.py: The SendResult.success check is correct — it converts a silently-failed delivery into a caught RuntimeError, which will be handled by the existing try/except around the send loop. This prevents the notifier from logging "delivered" when the message actually failed.

gateway/session_context.py: build_session_subprocess_env() properly bridges ContextVars to subprocess environments. The behavior change from the original inline code (setting empty-string values when ContextVar is explicitly set to "") is intentional and documented — this correctly distinguishes "never set" from "explicitly empty."

hermes_cli/kanban.py: Auto-subscribe on kanban create follows the same pattern as the slash-command handler. The json mode guard prevents implicit subscription in scripting contexts.

tools/environments/local.py: Clean refactor — delegates to the new shared helper.

All changes look correct. No issues found.

[teknium1]

Thanks for identifying the silent notifier-failure path. The notifier portion still addresses a real current-main defect: gateway/kanban_watchers.py:416-422 awaits adapter.send() but ignores its SendResult, while the rewind path at :448-476 only handles raised exceptions.

Problems

• In the added hermes_cli/kanban.py _cmd_create branch, kb.create_task() runs before incomplete explicit subscription arguments return status 2. Invalid one-sided flags therefore create a task but report failure without its ID. Validate the pair before task creation and test that no row is persisted.
• Do not carry the stale tools/environments/local.py replacement as written. Current main's _inject_session_context_env() (tools/environments/local.py:336-380, cc395e8050) strips unset session variables in engaged concurrent hosts; the PR helper's unset-to-os.environ fallback would defeat that guard if applied mechanically.
• Current main explicitly treats direct CLI/cron as having no persistent auto-subscription target (tools/kanban_tools.py:990-1032); gateway slash creates already subscribe at gateway/slash_commands.py:450-488.

Suggested changes

• Salvage the SendResult.success check with a current regression test, validate explicit arguments before creation, and leave the current session-env chokepoint intact.

Automated hermes-sweeper review.

[teknium1]

Closing — both halves are now covered on main: the SendResult(success=False) check landed earlier (rewind-on-soft-fail in the notifier), and CLI auto-subscribe-on-create is tracked by #50972's scope. Your report of the silent notifier-failure path was accurate and corroborated the reliability work that landed via #72236. Thanks!