fix(kanban): make run finalization shutdown-safe

[chrismaddern]

Summary

• finalize complete/block/reclaim/worker-exit races exactly once
• reconcile orphaned active runs before dispatcher claims new work
• track gateway Kanban DB threads and boundedly drain real SQLite writes on shutdown, including with a zero-second agent drain
• add concurrent race, restart reconciliation, and SIGTERM transaction fault-injection coverage

This branch includes the prerequisite DB-health commit from #65899 because that dependency is not yet on main.

Test plan

• scripts/run_tests.sh tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_db_health.py tests/hermes_cli/test_kanban_dispatch_lock.py tests/hermes_cli/test_kanban_run_finalization.py tests/gateway/test_kanban_db_circuit.py tests/gateway/test_kanban_watchers_mixin.py -q (256 passed)
• uv run ruff check gateway/kanban_watchers.py gateway/run.py hermes_cli/kanban_db.py tests/gateway/test_kanban_watchers_mixin.py tests/hermes_cli/test_kanban_run_finalization.py
• python -m compileall -q ...
• git diff --check

[alt-glitch]

This was generated by AI during triage.
Related to #65068 (detached-worker exit finalization) and same-author sibling #66912 (shared Kanban DB-health prerequisite). This PR adds a distinct gateway shutdown-drain/orphan-reconciliation path; please split or rebase the shared slice so the changes can be reviewed independently.

[teknium1]

The finalization and shutdown-tracking direction addresses gaps still present on current main: _end_run does not inspect its run-row update result (hermes_cli/kanban_db.py:3262-3290), dispatch does not reconcile orphaned runs before reclaim/claim work (hermes_cli/kanban_db.py:7551-7556), and gateway shutdown does not track Kanban to_thread work (gateway/run.py:8452; gateway/kanban_watchers.py:298).

Problems

• The shared DB-health prerequisite (e97692b) overlaps the active consolidation in #66912, as the MEMBER comment notes. Please split that prerequisite from the targeted finalization slice so it can be reviewed independently.
• tests/hermes_cli/test_kanban_core_functionality.py:3749 renames an existing test to _legacy_gateway_dispatcher_retries_after_ttl; pytest will no longer collect it, leaving obsolete dead test code.

Suggested changes

• Keep the e7639f2 finalization/shutdown slice separate from the DB-health prerequisite and consolidate the latter through #66912.
• Remove the uncollected legacy helper, or make it an executed assertion of the supported recovery behavior.

Automated hermes-sweeper review.

[teknium1]

This rename removes the previous test from pytest collection but retains its obsolete implementation as dead code. Please delete it, or replace it with an executed test for the supported recovery contract.