feat(kanban): persist canonical notification session routing

[JnyRoad]

Summary

• Persist a canonical notification route: session key, platform, chat type, thread, profile, and a non-secret adapter identity.
• Route notifications through the exact active or secondary profile adapter without falling back across profiles.
• Keep legacy, partial, CLI, and tool-originated subscriptions notify-only; this PR intentionally does not wake an agent.
• Preserve old databases with additive nullable migrations and refuse to infer missing canonical fields.

Validation

• scripts/run_tests.sh tests/gateway/test_kanban_notifier.py tests/gateway/test_session_env.py tests/hermes_cli/test_kanban_db_init.py tests/hermes_cli/test_kanban_notify.py tests/plugins/test_kanban_dashboard_plugin.py tests/tools/test_kanban_tools.py -q (278 passed)
• python scripts/check-windows-footguns.py gateway/kanban_watchers.py gateway/run.py gateway/session_context.py gateway/slash_commands.py hermes_cli/kanban_db.py tools/kanban_tools.py tests/gateway/test_kanban_notifier.py tests/gateway/test_session_env.py tests/hermes_cli/test_kanban_db_init.py tests/hermes_cli/test_kanban_notify.py tests/plugins/test_kanban_dashboard_plugin.py tests/tools/test_kanban_tools.py

The full repository suite currently has unrelated environment and platform failures on this macOS runner; this change's focused suite is green.

[alt-glitch]

This was generated by AI during triage.

Related to #68998, #56531, and #56632. This PR adds canonical route persistence while deliberately keeping subscriptions notify-only; a maintainer decision is needed on whether trusted routes should support durable authorized agent wakeups.

[teknium1]

Thanks for the careful route-persistence and migration work. Current main has moved to a different, maintainer-selected notification model.

Problems

• This PR intentionally removes wakeups, but current gateway/kanban_watchers.py:707-751 retains a chat-type-correct deliver_wake path after notification. Merged PR fix(gateway): deliver kanban/delegate wake-ups to api_server sessions (#64998 salvage) #70171 added durable API-server wake delivery, and merged PR fix(kanban): profile-correct notification ownership and routing (salvage #57995, #56589, #62380, #69181) #72241 explicitly lists feat(kanban): persist canonical notification session routing #69020 as a separate design decision.
• The current subscription model persists chat_type and delivery_metadata in hermes_cli/kanban_db.py:9428-9529; the PR's older schema and notifier implementation overlap that changed surface. GitHub also reports this PR as merge-conflicted.

Suggested changes

• Resolve the notify-only versus wake-enabled product decision before attempting salvage.
• If the canonical route fields are still desired, integrate them into the current _authorization_adapter / deliver_wake flow and preserve the existing push and API-server wake regressions.

Automated hermes-sweeper review.