fix(tools): preserve Kanban lifecycle tools for task workers

[OddBallin]

What changed

• Preserve the Kanban lifecycle toolset for dispatcher-scoped workers identified by HERMES_KANBAN_TASK, even when the assignee profile disables the ordinary-chat kanban toolset.
• Keep the existing disabled-toolset behavior unchanged for normal chat sessions.
• Add regression coverage across direct schema resolution, AIAgent tool assembly, and worker prompt guidance.

Why

Assignee profiles may intentionally disable Kanban tools during ordinary chat. That same profile restriction was also applied after the dispatcher scoped a process as a Kanban worker, stripping the lifecycle tools the worker needs to inspect, heartbeat, comment, create/link child tasks, block, and complete its assigned task.

The worker environment is already constrained by Kanban task-scoped check_fn guards. This change makes that task scope the narrow exception while preserving the profile restriction everywhere else.

How to test

python -m pytest -q \
  tests/tools/test_kanban_tools.py \
  tests/hermes_cli/test_kanban_worker_spawn_toolsets.py
python -m ruff check model_tools.py tests/tools/test_kanban_tools.py
git diff --check upstream/main...HEAD

Verified locally:

• 103 tests passed
• Ruff check passed
• clean merge-tree against current upstream/main
• changed paths are limited to model_tools.py and tests/tools/test_kanban_tools.py

Platform tested

• macOS 26.5.1

[teknium1]

Thanks for the focused regression fix. The premise is confirmed on current main: model_tools.py:369-375 adds kanban for a task-scoped worker, but the later subtraction at model_tools.py:395-427 removes it again when the assignee profile has agent.disabled_toolsets: [kanban]. The dispatcher sets HERMES_KANBAN_TASK before worker startup in hermes_cli/kanban_db.py:7729, and the CLI forwards the configured disabled set to AIAgent through cli.py:3879 and hermes_cli/cli_agent_setup_mixin.py:354-355.

The proposed exception is narrow. Worker lifecycle tools remain gated by _check_kanban_mode (tools/kanban_tools.py:65-79), while kanban_list and kanban_unblock remain excluded from worker schemas by _check_kanban_orchestrator_mode (tools/kanban_tools.py:82-93, registrations at tools/kanban_tools.py:1602-1608 and 1656-1662). The added tests cover schema resolution, AIAgent assembly, prompt guidance, and the normal-chat non-worker case.

Automated hermes-sweeper review.

[alt-glitch]

This was generated by AI during triage.

Related: closes a gap left by the merged #28396. On current main (model_tools.py:369-375) the kanban toolset is re-added for HERMES_KANBAN_TASK workers only when it's absent from the effective enabled set; a profile that explicitly disables kanban still strips the worker's lifecycle tools. This PR handles that explicit-disable case. Incremental fix, not a duplicate of #28396.