fix: scope kanban auto-subscriptions to active profile

[tymrtn]

Summary

• stamp Kanban auto-subscribe rows with the active profile when session/env profile markers are absent
• preserve existing HERMES_SESSION_PROFILE / HERMES_PROFILE behavior when present
• add regression coverage for gateway sessions that have a shared Telegram chat ID but no exported profile marker

Fixes #57993.

Why

In multi-bot installs, telegram:<chat_id> is not a complete delivery identity. If a Kanban notification subscription is written with notifier_profile=None, another profile's Telegram gateway that shares the same human chat can claim and deliver the task's terminal event.

The notifier already respects notifier_profile; this patch makes the auto-subscribe path reliably populate it from get_active_profile_name() as a fallback.

Tests

• scripts/run_tests.sh tests/tools/test_kanban_tools.py tests/gateway/test_kanban_notifier.py — 105 passed
• python -m pytest tests/tools/test_kanban_tools.py -q — 98 passed (Codex review lane)
• python -m pytest tests/hermes_cli/test_kanban_notify.py tests/gateway/test_kanban_notifier.py -q — 19 passed (Codex review lane)
• git diff --check

Review

Codex reviewed the uncommitted diff and reported no blocking correctness issues.

[teknium1]

Merged via PR #72241 — your commit was cherry-picked onto current main with your authorship preserved. The get_active_profile_name() fallback stamp closes the NULL-owner leak (#57993). Thanks!