fix(kanban): report durable artifact paths on completion

[hughmadden]

Summary

• return the final persisted artifact paths from successful kanban_complete calls
• ensure scratch-workspace artifacts point at their durable task attachment copies after cleanup
• add a regression test covering the transcript-facing result

Why

Hermes Desktop indexes generated files from session tool results. kanban_complete preserved declared scratch artifacts correctly, but returned only ok, task_id, and run_id. Desktop therefore indexed earlier temporary workspace paths and missed the durable attachment path, leaving dead file links after scratch cleanup.

Tests

• pytest tests/tools/test_kanban_tools.py -o addopts= -q — 28 passed
• pytest tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_notify.py -o addopts= -q — 32 passed
• python3 -m py_compile tools/kanban_tools.py tests/tools/test_kanban_tools.py
• git diff --check

[enzo-adami]

Independent validation on today's origin/main (165c889e5b4277b56dadd42949a4112c1e6175a6) and, importantly, in combination with the hardened artifact-confinement patch from #86610 (95a2f8bbf6a096ea156cb18268760ae08d172440): both patches apply cleanly, git diff --check passes, and the relevant suite is green through the repository runner.

scripts/run_tests.sh \
  tests/tools/test_kanban_tools.py \
  tests/hermes_cli/test_kanban_db.py \
  tests/hermes_cli/test_kanban_notify.py \
  tests/gateway/test_kanban_watchers_mixin.py -q

107 passed, 0 failed (1 Windows-only skip on macOS)

This PR remains complementary rather than overlapping: #86610 confines/copies declared workspace artifacts and rewrites run metadata to the durable attachment paths; this PR exposes exactly those rewritten paths in the kanban_complete tool result so Desktop's artifact browser does not retain the deleted workspace path. I found no contract dilution in the combined tree.

[enzo-adami]

Fresh sequencing check against the current heads:

• main: 165c889e5b4277b56dadd42949a4112c1e6175a6
• confinement PR fix(kanban): confine completion artifacts to task workspace #86610: ab93d6bf7d3b55d01da941e26ac43d7766faa7f0
• this PR: 3d10ac8fb5db748746b1df49c1bd1890aa743429

Recommended landing order is #86610 first, then rebase/land #82908.

Reason: this PR already implements the required Desktop-facing UX and does not need an extension. Its base can persist scratch artifacts, but non-scratch/out-of-workspace entries may remain plain metadata paths. #86610 supplies the stronger invariant: declared artifacts are confined to the task workspace, copied into the pinned append-only attachment destination, and the completed run metadata is rewritten to those durable paths. Once that invariant exists, this PR exposes exactly those rewritten paths. Landing #82908 first would create a transient period where the response can describe paths that are not covered by the stronger staged/confinement contract.

I applied this exact commit without conflicts on top of the current #86610 head and re-ran the relevant suite through the repository runner:

107 passed, 0 failed, 1 Windows-only skip on macOS
Ruff PASS
Windows footgun scan PASS (970 files)
git diff --check PASS

No duplicate open PR was found for this response contract. #75572 validates external artifact existence but does not return the durable paths and should not substitute for this PR or #86610's stricter confinement/staging semantics.