fix(kanban): distinguish orchestrator prompt guidance

[mloesche]

Summary

• distinguish dispatcher workers from opted-in Kanban orchestrators using HERMES_KANBAN_TASK
• keep worker lifecycle guidance for assigned tasks
• give normal orchestrator sessions list-first guidance with an explicit task ID for kanban_show
• preserve session-static prompt caching and the fallback prompt path

Root cause

kanban_show is available to both workers and configured orchestrators, but prompt selection treated tool presence as proof that the process owned a task. Normal orchestrator chats therefore received worker-only instructions to call kanban_show() without an ID.

Verification

• scripts/run_tests.sh tests/tools/test_kanban_tools.py tests/agent/test_system_prompt.py tests/agent/test_system_prompt_restore.py -q — 52 passed
• ruff check on all changed files — passed
• real Geordi profile prompt probe confirmed orchestrator guidance present, worker claim absent, list-first and explicit-ID instructions present
• two independent reviews found no blocking correctness or security issues

[alt-glitch]

This was generated by AI during triage.

Duplicate of #68608: both split worker and orchestrator prompt guidance using HERMES_KANBAN_TASK; #68608 also covers the fallback path.

[teknium1]

Thanks for isolating the worker/orchestrator distinction; the underlying defect is present on current main.

Problems

• agent/prompt_builder.py adds an orchestrator block but drops routing safeguards currently injected through KANBAN_GUIDANCE: real-profile discovery and parents=[...] dependencies (agent/prompt_builder.py:287-290), captured-only created-card IDs (agent/prompt_builder.py:284-286), and attachment handling (agent/prompt_builder.py:280-283). Those details were deliberately folded into injected guidance by 84e1d31e5442eeff0bfcf1c2ffab6acf7fe95f45; preserve them in the new orchestrator block.
• The changed bypass-init branch in agent/system_prompt.py has no direct regression coverage. The added test covers normal AIAgent initialization only.

Suggested changes

• Carry the load-bearing routing rules into KANBAN_ORCHESTRATOR_GUIDANCE; the open duplicate PR feat(agent): board-orchestration guidance for kanban-enabled sessions without an owned task #68608 contains a fuller version of this split.
• Add a test that deletes _kanban_worker_guidance and verifies both fallback branches.

Automated hermes-sweeper review.