fix(kanban): harden auto-triage and worker process cleanup

[ChanPark03]

Summary

• keep block-loop triage rows out of auto-decompose and filter them before the selector limit
• terminate reclaimed/crashed worker process groups so descendants do not survive a dead wrapper
• retain fail-closed process-group ownership checks and explicit POSIX-only CI annotations

Verification

• scripts/run_tests.sh tests/hermes_cli/test_kanban_decompose.py tests/hermes_cli/test_kanban_db.py
• 243 passed, 0 failed on current upstream main
• python scripts/check-windows-footguns.py --diff origin/main — PASS
• git diff --check origin/main...HEAD

The commits preserve their original authorship and were rebased onto current upstream main.

[teknium1]

Thanks for the focused hardening work. Current main still routes auto-decomposition through the unfiltered selector at gateway/kanban_watchers.py:1367 / hermes_cli/kanban_decompose.py:459-468, and its cleanup helper signals only the recorded PID at hermes_cli/kanban_db.py:6903-6927 despite workers being spawned with start_new_session=True at hermes_cli/kanban_db.py:8973-8981. The changes in dd49dce9c80f address those exact paths with pre-limit filtering and guarded process-group cleanup.

The related #69942 triage comment identifies overlapping worker-lifecycle work but explicitly says it is not a duplicate; the auto-triage selection fix here remains distinct.

Automated hermes-sweeper review.