fix(kanban): bind auto-subscriptions to active profile

[Gigisanta]

Summary

Fixes #57993.

Kanban auto-subscriptions could be stored with notifier_profile=NULL whenever gateway session metadata and HERMES_PROFILE were absent. In a multi-profile fleet, any gateway sharing the platform/chat could then claim and deliver that terminal event through the wrong bot.

When explicit session/environment ownership is unavailable, _maybe_auto_subscribe() now resolves the active Hermes profile through the canonical profile resolver before writing the subscription. Existing explicit ownership precedence is unchanged.

Tests

• python -m pytest -q tests/tools/test_kanban_tools.py tests/hermes_cli/test_kanban_notify.py tests/gateway/test_kanban_notifier.py
• 133 passed
• git diff --check

[alt-glitch]

This was generated by AI during triage.

Duplicate of #57995 — both add the same active-profile fallback for ownerless Kanban auto-subscriptions.

[teknium1]

Thanks for the focused regression fix. The premise is confirmed on current main: tools/kanban_tools.py:1256-1267 can persist an ownerless subscription, while hermes_cli/kanban_db.py:8775-8779 writes that value directly. The added fallback preserves the existing explicit session/environment precedence and uses the canonical resolver at hermes_cli/profiles.py:1832-1856.

Sibling production writers already supply an owner: hermes_cli/kanban.py:2541-2545, gateway/slash_commands.py:504-510, and plugins/kanban/dashboard/plugin_api.py:1834-1841. The existing notifier regression at tests/gateway/test_kanban_notifier.py:240-294 verifies that a stamped owner cannot fall back to another profile's same-platform bot.

Automated hermes-sweeper review.