fix(kanban): base task worktrees on remote default

[brb79]

Summary

• fetch the selected Git remote before materializing a new Kanban task worktree
• resolve the live remote default branch instead of using the canonical checkout's current HEAD or cached <remote>/HEAD
• fail closed when a configured remote cannot be enumerated, fetched, or resolved; preserve HEAD fallback for local-only repositories
• leave the canonical checkout and existing task branches/worktrees untouched

Root cause

_ensure_git_worktree created new task branches with git worktree add -b ... HEAD. If a board's canonical checkout was on a stale or unrelated feature branch, every automatically materialized task worktree inherited that stale base.

Verification

• tests/hermes_cli/test_kanban_db.py: 234 passed
• broader Kanban CLI/board/project/workspace/dashboard selection: 223 passed
• focused remote-default regressions: 4 passed under the canonical runner
• ruff check on changed files: passed
• git diff --check: passed
• independent fresh-context review: passed with no logic or security findings

No installed Hermes checkout, gateway process, or active Kanban board was modified by this branch.

[alt-glitch]

This was generated by AI during triage.

Related to #61626. Both address stale bases for dispatched Kanban worktrees through different worktree-creation paths; maintainers should consolidate the remote-tip contract.

[teknium1]

Thanks for isolating the current-head stale-base defect; it is still present on current main at hermes_cli/kanban_db.py:6265-6268.

Problems

• The new resolver always chooses a remote default branch. The established interactive contract deliberately prefers the checked-out branch's fetched upstream first (cli.py:1464-1494), then the remote default (cli.py:1498-1520). This matters for a board intentionally anchored on a tracked feature branch.
• The new base_ref path always fetches and fails when a configured remote is unavailable. That bypasses worktree_sync: false and differs from the documented offline fallback to local HEAD (cli.py:1524-1525, cli.py:1580-1604; website/docs/user-guide/configuration.md:719-723).
• This duplicates the base-selection policy rather than consolidating it. The member note links #61626 specifically for a shared remote-tip contract.

Suggested changes

• Reuse/extract the interactive resolver for Kanban, preserving upstream-first resolution, worktree_sync, and fail-soft HEAD fallback. Cover those paths in the Kanban regressions.

Automated hermes-sweeper review.

[teknium1]

This unconditionally selects the new resolver, so Kanban no longer has the documented worktree_sync: false opt-out or the interactive path's offline fallback to local HEAD (cli.py:1524-1525, 1580-1604). Please route this through the shared interactive base-resolution contract instead.