fix(kanban): isolate background-review lifecycle

[silverdale-admin]

Summary

• prevent background skill/memory review forks from recording Kanban task failures inherited from their parent process environment
• preserve normal budget-exhaustion failure recording for dispatcher-owned workers
• add regression coverage at both fork setup and turn-finalization boundaries

Problem

A background review fork runs in-process and inherits HERMES_KANBAN_TASK from a dispatcher-spawned worker. The fork has its own hardcoded 16-iteration budget. If it exhausts that budget, turn_finalizer.py sees the inherited task id and records a second task failure against the parent card.

In production this appears as a real worker timeout followed seconds later by a synthetic auxiliary failure, for example:

60/60 timed_out
16/16 gave_up

The review fork does not own the task claim or run and must not advance the parent card's failure circuit.

Fix

Add an agent-local Kanban lifecycle ownership flag. Background review forks set the opt-out before run_conversation(). The turn finalizer consults it before resolving HERMES_KANBAN_TASK and recording a budget-exhaustion failure.

This uses agent-local state rather than mutating os.environ, which would be unsafe because the review runs in a thread inside the parent worker process.

Test plan

• scripts/run_tests.sh tests/agent/test_turn_finalizer_iteration_limit_exit.py tests/agent/test_turn_finalizer_interrupt_alternation.py tests/agent/test_turn_finalizer_final_response_persistence.py tests/agent/test_turn_finalizer_cleanup_guard.py tests/test_background_review_session_isolation.py tests/test_background_review_list_shapes.py tests/run_agent/test_background_review.py tests/run_agent/test_background_review_toolset_restriction.py tests/run_agent/test_background_review_summary.py tests/run_agent/test_background_review_cost_controls.py tests/run_agent/test_background_review_cache_parity.py -q
• full scripts/run_tests.sh -q

Related: #71175. This fixes the auxiliary 16/16 false-failure component; it is complementary to #71189's goal-mode claim-retention work.

[silverdale-admin]

Verification on pushed commit 7767000ab:

• Focused lifecycle suite: 53 passed, 0 failed
• Covers turn-finalizer iteration exhaustion plus background-review fork setup, isolation, restrictions, summaries, and cache controls.
• Independent review found no blocking issues.

The earlier full-repository run was stopped during an operator-requested WebUI restart. Its observed failures were in unrelated optional/integration suites (for example Hindsight/Modal dependencies); this PR does not claim a clean full-suite result.

[silverdale-admin]

Full-suite follow-up on macOS:

• PR branch full run: 45 failed, with failures confined to 18 unrelated files; two browser test files timed out.
• Re-ran six representative failing files serially on the PR branch: 182 passed, 12 failed.
• Ran the same six files serially in a clean detached worktree at current origin/main (8f52040dd): 175 passed, 6 failed.
• The key WSL2 voice-mode failures reproduce identically on untouched origin/main, as do shutdown-forensics, systemd abstract-socket, service-manager mode, and missing Hindsight dependency failures.
• None of the full-suite failures are in the five files changed by this PR.
• PR-focused lifecycle suite remains 53 passed, 0 failed.

Conclusion: the complete local suite is not green on this macOS environment, but the observed failures are baseline/environmental and not regressions introduced by this patch.