feat(kanban): per-task model dropdown — override worker model+provider from the board

[teknium1]

Summary

Kanban tasks now have a working model/provider override you can set from the board — a dropdown in the task drawer switches which model a worker runs on its next dispatch, without touching the worker profile's config.

The tasks.model_override column has existed since May 2026 (#26897 era) but had no write path — no CLI flag, no API field, no UI. It was only settable by hand-editing SQLite. This PR adds the write path on every surface and pairs it with a provider_override so cross-provider switches resolve correctly (a model name alone is resolved against the worker profile's provider and fails when it belongs to a different one — the exact mismatch users hit when agents write "model from provider A" on a profile configured for provider B).

Changes

• hermes_cli/kanban_db.py: provider_override column (+ additive migration), set_model_override() (validates provider-requires-model, allowed on running tasks, refuses archived, emits model_override_set event), create_task(model_override=, provider_override=), dispatcher spawn now passes -m <model> [--provider <name>]
• plugins/kanban/dashboard/plugin_api.py: model_override/provider_override/clear_model_override on PATCH /tasks/:id and POST /tasks/bulk, override fields on task create, new GET /model-options endpoint (thin wrapper over build_models_payload — same substrate as the Models page/TUI picker, no pricing/probes so the drawer never blocks on a slow endpoint, degrades to {providers: []})
• plugins/kanban/dashboard/dist/index.js: ModelEditor row in the task drawer — provider-grouped <select> with "(profile default)" clear option, module-level catalog cache, out-of-catalog current value stays selectable, free-text fallback when the catalog is empty
• hermes_cli/kanban.py: kanban create --model/--provider, new kanban set-model <task> <model|none> [--provider] subcommand, show prints model: X (provider: Y), JSON output carries both fields
• tools/kanban_tools.py: kanban_create accepts model/provider params (orchestrators can pin children); kanban_show/kanban_list expose provider_override

Rate-limit recovery flow

Worker hits a provider rate limit → open the task drawer → pick a different provider's model from the dropdown → reclaim/retry. The override applies on the next dispatch; the profile's configured model is never modified. Clearing returns the task to the profile default. Works in bulk for multi-task boards.

Validation

Check	Result
New tests (tests/plugins/test_kanban_model_override.py)	17/17 pass
Sibling kanban suites (db, cli, spawn, dashboard, tools, core)	682/682 pass
E2E: legacy DB (no column) → migration → set override	pass
E2E: spawn argv round-trips through the real CLI parser (args.model, args.provider)	pass
Live CLI: create --model --provider → show → set-model → clear	pass

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 82b8b7c}

all good!