feat(kanban): add configurable board presentation

[TheDuggieB]

Summary

Adds a generic, board-configured Kanban presentation layer under board.json.presentation while preserving SQLite lifecycle state as the canonical source of truth.

Boards that do not configure presentation metadata retain their existing behavior. Configured boards can expose read-only virtual lanes selected by declarative, allowlisted predicates rather than executable expressions or templates.

Architecture

• Stores presentation configuration in board metadata with an explicit schema version and revision.
• Builds virtual projection lanes server-side without translating them back into canonical lifecycle statuses.
• Keeps unconfigured boards on the legacy response path and omits presentation output.
• Adds board-scoped CLI operations to show, validate, set, and clear presentation metadata.
• Adds dashboard API validation and compare-and-swap mutation endpoints.
• Renders projection diagnostics and read-only virtual cards in the dashboard.

Safety and security controls

• Strict JSON decoding rejects duplicate keys, non-finite values, numeric overflow, oversized integers, invalid encoding, excessive depth, and excessive node counts.
• Metadata mutation reads strictly while locked and fails closed if existing metadata is malformed, unreadable, or changes unexpectedly.
• Failed mutations preserve the original metadata bytes.
• Presentation API bodies reject unknown top-level fields and duplicate JSON keys.
• Presentation changes require exact expected revisions and capture response state under the metadata lock.
• Virtual projection IDs are rejected at backend lifecycle-write boundaries.
• Projection-originated drag/drop, bulk actions, inline creation, and lifecycle controls are disabled in the frontend.
• Structured projection markers and Health Proof evidence are accepted only from the current task body, not historical results or run summaries.
• Health Proof timestamps must be typed, healthy, current, and never future-dated.
• Request-body size limits are enforced incrementally before the entire body is buffered.

Migration behavior

No database migration is required.

• Existing SQLite task lifecycle state remains canonical and unchanged.
• Existing boards without board.json.presentation retain legacy behavior.
• Presentation can be introduced per board using the validation and CAS-protected set operation.
• Malformed existing board metadata blocks mutation rather than being rewritten.

Rollback strategy

• Clear the board's presentation metadata using the revision-checked CLI/API operation to restore legacy rendering.
• Revert the feature commit if the capability must be removed from the codebase.
• No canonical task statuses need translation or repair because projection lanes are virtual and read-only.
• No live board configuration or production deployment is included in this PR.

Verification

Original reviewed candidate:

• Parent: 07e97d2f5dc3d2092cfe693ef07b2527a36cd2d8
• Tree: d22c64b5f5d60e680fdd67760bdd912d116adc2f
• Signed commit: 3202033ca9b54825bbe6244bb2532bb89212a5c0
• Binary diff SHA-256: fe6ed35cd4d7ea90dae843c77d97dafecac9924cd08c780944908a514b327455
• Signature: VALIDSIG 2E8C4BFF965E8EB00B542082E05FB5BEE023FCA0
• Independent exact-candidate review: PASS
• Parent validation before upstream integration: 447 passed
• Independent review suites before upstream integration: 161 focused and 217 changed-surface tests passed

Current-upstream integration validation:

• Current upstream integration commit: f2830c9543bd4db7330c389f3926ea9c59d81c77
• Integration tree: d264b0514cab44def950982dc493bc00b1a66dc9
• Feature delta SHA-256 against reviewed upstream parent: dfe9933ac5bfb13272b548d3f51eb4969d613ac2739412ff313722fba89b7d9a
• Merge commit signature: VALIDSIG 2E8C4BFF965E8EB00B542082E05FB5BEE023FCA0
• Relevant merged suite: 125 passed
• Python compilation: PASS
• Dashboard JavaScript syntax: PASS
• Feature-only git diff --check against the reviewed upstream parent: PASS
• Independent exact-tree integration review: PASS (deleg_18af29ab)
• Future heartbeat regression: every timestamp after now fails closed; current and stale boundaries independently verified

Scope boundaries

This PR does not:

• configure any live board;
• change canonical lifecycle statuses;
• deploy or restart a service;
• mutate a production Kanban database;
• introduce SalesOS-specific vocabulary into shared implementation, tests, UI, or documentation.

[teknium1]

Thanks for the substantial board-presentation implementation. Remote main still serializes canonical status columns in plugins/kanban/dashboard/plugin_api.py:452-508, so this is not superseded.

Problems

• tests/plugins/test_kanban_dashboard_plugin.py:397-420 reads dist/index.js and asserts exact bundle substrings; similar assertions begin at :556. Current AGENTS.md:1382-1416 explicitly bans source-text tests because they test implementation shape, not behavior.

Suggested changes

• Replace those assertions with observable UI behavior coverage for projection labels, read-only interaction suppression, and diagnostics. Keep the REST projection tests, which already exercise the backend contract.

Automated hermes-sweeper review.