fix(kanban): worker-created child tasks get their own workspace

[teknium1]

fix(kanban): worker-created child tasks get their own workspace

Summary

kanban_create called by a running worker no longer copies the parent task's literal workspace_kind/workspace_path into the child — omitted workspace args now produce a fresh isolated scratch task (workspace_path=NULL, materialized to <board>/workspaces/<child-id> at dispatch), so a remediation child can no longer mutate an independent review's evidence directory or share a checkout/index with concurrent tasks.

Salvage of #67570 by @peacockesq (both commits cherry-picked, authorship preserved), rebased onto current main. Fixes #67567.

Behavior contract after this change:

• Omitted workspace → fresh isolated scratch child, own deterministic path; nested worker children preserve the invariant
• Explicit workspace_kind=dir + workspace_path → intentional sharing, unchanged
• Project-linked parent, workspace omitted → child inherits only project_id, materializing its own worktree + branch; a cross-profile fallback (project_source_task_id) recovers repo/branch convention from the canonical source task without ever reusing its literal worktree
• CLI/dashboard creation without worker context → unchanged

Changes

• tools/kanban_tools.py::_handle_create: drop implicit literal workspace inheritance; inherit only project_id; surface resolved workspace_kind/workspace_path/project_id in the tool response and created event.
• hermes_cli/kanban_db.py::create_task: project_source_task_id cross-profile fallback (worker profiles have separate projects.db; the shared board's canonical project-linked task supplies repo + branch convention, path is never reused).
• tests/tools/test_kanban_tools.py: isolation matrix — materialized-scratch parent, nested children, explicit dir sharing, explicit scratch, project-linked child with own worktree/branch, cross-profile routing (~295 new test lines).

Validation

	Before	After
Default child of a materialized scratch parent	same literal parent path	own <board>/workspaces/<child-id>
Parent review evidence	mutable by child	untouched (E2E-verified)
Explicit dir sharing	works	unchanged
Project-linked child	shared literal worktree possible	own worktree + branch

• scripts/run_tests.sh tests/tools/test_kanban_tools.py tests/hermes_cli/test_kanban_project_link.py tests/hermes_cli/test_kanban_decompose.py — 132 passed
• Broader kanban suites (tools/db/cli/decompose/goal-mode/dispatch) — 440 passed; the single test_connect_falls_back_to_delete_on_locking_protocol failure reproduces identically with main's files checked out and passes in isolation — pre-existing intra-file isolation flake, unrelated to this change
• Live E2E (real temp board): worker-created child with omitted args resolves to its own workspace path; parent's review-evidence.txt intact

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 38e623b}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

2 visual diffs.

_{inline evidence upload failed.}

Failed to upload diff-fe0af89a78a7-boot-failure-error-state-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-fe0af89a78a7-boot-failure-error-state-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso)

[alt-glitch]

This was generated by AI during triage.

Supersedes the broader workspace-isolation approach in #67570 while preserving its authorship. Related: #67574 is the narrower scratch-child repair.