fix(kanban): preserve initial blocked approval gates

[Veritas-7]

Summary

• emit a sticky blocked event when a Kanban task is created with initial_status="blocked"
• prevent recompute_ready() / dispatcher ticks from auto-promoting approval-gated blocked tasks before an explicit unblock
• add regressions for both parentless and parent-done initial blocked tasks

Fixes #39609.

Why

create_task(initial_status="blocked") wrote tasks.status='blocked' but did not emit a blocked event. The sticky-block guard only checks blocked / unblocked events, so a newly created blocked task could be treated like a transient recoverable block and promoted to ready on the next recompute/dispatcher pass.

--initial-status blocked is documented as a human/operator gate. It should stay inert until an explicit unblock.

Testing

• python -m pytest tests/hermes_cli/test_kanban_blocked_sticky.py tests/hermes_cli/test_kanban_cli.py tests/hermes_cli/test_kanban_db.py tests/tools/test_kanban_tools.py -q -o 'addopts=' → 353 passed, 1 warning
• manual isolated smoke: initial blocked child with completed parent stayed blocked, recompute_ready() returned 0, events were ['created', 'blocked']
• gitleaks git --log-opts='origin/main..HEAD' --no-banner --redact → no leaks found