fix(kanban): salvage partial findings on iteration-budget exhaustion

[DanielMaly]

Summary

When a Kanban worker exhausts its iteration budget, the agent loop asks the model for a final toolless summary via _handle_max_iterations(). Previously that summary was discarded — _record_task_failure() was called without forwarding it, so the run row closed with summary=None and the retry worker started from scratch with no partial findings.

This PR forwards the model's last output as partial_summary to _record_task_failure, which writes it to the run row's summary field via _end_run. build_worker_context already surfaces run summaries in the prior-attempts section, so the retry worker sees the partial findings automatically.

Additionally, a [partial_unverified] task comment is posted containing the model's last output, so it appears in the retry worker's comment thread. The tag marks it as emergency-salvaged content from a budget-exhausted run, not a deliberate handoff.

Closes #52510

Root cause

In agent/turn_finalizer.py, the budget-exhaustion path calls _record_task_failure(outcome="timed_out") but never passes the final_response (the model's last output from _handle_max_iterations). The _record_task_failure function had no parameter to accept a partial summary, and _end_run() was called without summary=, leaving the run row's summary field as NULL.

Changes

• hermes_cli/kanban_db.py: Add partial_summary parameter to _record_task_failure(), forwarded to _end_run(summary=...) in both the breaker-trip (gave_up) and below-threshold paths.
• agent/turn_finalizer.py: Forward final_response as partial_summary to _record_task_failure; post a [partial_unverified] comment with the model's last output; improve the comment explaining why _record_task_failure is used instead of kanban_block (separating the two concerns: circuit-breaker counting vs. tools being stripped).
• agent/prompt_builder.py: Add a brief iteration-budget-exhaustion paragraph to KANBAN_GUIDANCE so workers know the salvage mechanism exists and are encouraged to proactively kanban_comment + kanban_block before hitting the cap.
• Tests: 7 new tests — 3 in test_kanban_db.py covering partial_summary plumbing (timed_out / gave_up / null cases), 4 in test_turn_finalizer_kanban_salvage.py covering the end-to-end salvage flow.

Design choices

• No fabrication risk: The salvaged text is genuine model output, clearly tagged [partial_unverified].
• No recursion risk: Tools are stripped before _handle_max_iterations, so the model cannot call kanban tools during the summary API call.
• No double-recording risk: Status gating prevents the dispatcher's crash detector from re-recording.
• Why not reserved finalization tool turn: A reserved-tool-turn approach (enforcing a budget so one tool call remains for handoff) is more complex and changes agent loop semantics. The current approach is simpler and sufficient — it salvages what the model already produces. This approach is complementary and could be added later if needed.
• failure_limit not passed from turn_finalizer: The worker process does not have access to the dispatcher's kanban.failure_limit config. The _record_task_failure default (DEFAULT_FAILURE_LIMIT) is acceptable here — the per-task max_retries override still takes precedence when set.

Test plan

• test_record_task_failure_salvages_partial_summary — verifies partial_summary lands in run row's summary and is surfaced by build_worker_context
• test_record_task_failure_without_partial_summary_stays_null — backward-compatible default (existing callers unaffected)
• test_record_task_failure_partial_summary_on_gave_up — partial summary persists when circuit breaker trips
• test_budget_exhaustion_salvages_partial_summary_to_run — end-to-end: finalize_turn forwards model output to run summary
• test_budget_exhaustion_writes_partial_unverified_comment — [partial_unverified] comment is written with correct author
• test_budget_exhaustion_no_summary_no_comment — no comment when model produces empty summary
• test_budget_exhaustion_retry_worker_sees_partial_findings — retry worker's build_worker_context contains both the partial summary and the comment
• 236 existing kanban_db + turn_finalizer tests still pass (no regressions)

[teknium1]

Thanks for tracing the run-summary loss; current main still closes the Kanban timeout run without a summary, while retry context renders closed-run summaries.

Problems

• Current main has a second iteration-limit fallback: agent/turn_finalizer.py:72-81 preserves _pending_verification_response without calling _handle_max_iterations. The regression at tests/agent/test_turn_finalizer_iteration_limit_exit.py:135-149 verifies that behavior. The PR's new [partial_unverified] comment calls every saved value the worker's last model output before timeout, which is not true for this preserved-response path.

Suggested changes

• On salvage, distinguish a generated toolless summary from a preserved verification response, or use origin-neutral wording; add coverage alongside tests/agent/test_turn_finalizer_iteration_limit_exit.py:270-298.
• The summary plumbing remains useful: current hermes_cli/kanban_db.py:6906-6911 closes the run without a summary, and hermes_cli/kanban_db.py:8242-8275 exposes summaries to retries.

Automated hermes-sweeper review.