feat: add independent Kanban review templates

[alexgunsberg]

Summary

• add configurable kanban.decompose_templates matching with project anchors and path signals
• enforce a separate implementation lane and terminal independent-review child with distinct installed profiles
• embed explicit mention-gating and cross-profile credential-isolation policy in generated work
• harden malformed/missing-profile behavior, reviewer dependency cycles, generic-owner leakage, and policy-marker spoofing

SL routing configured for the originating deployment

• analysis/editorial: suomen-liittokunta implements; academic reviews
• web ship/deploy: websites implements; academic reviews

The repository change is generic and only activates for configured templates.

Verification

• uv run --extra dev pytest tests/hermes_cli/test_kanban_decompose.py tests/hermes_cli/test_kanban_decompose_db.py -o 'addopts=' -q — 16 passed
• uv run --extra dev ruff check hermes_cli/kanban_decompose.py hermes_cli/kanban_decompose_templates.py tests/hermes_cli/test_kanban_decompose.py — passed
• git diff --check HEAD^ — passed
• independent review caught and drove fixes for implementer leakage, policy-marker spoofing, review cycles, and reviewer-assignee misclassification