feat(agent): add kanban-comment note channel, separate from user /steer

[steveonjava]

Kanban comments injected mid-turn currently use the same STEER_MARKER envelope as a genuine user /steer. That gives task-thread comments user-level authority they do not have.

This adds a sibling Kanban-comment envelope while leaving the existing STEER_MARKER mechanism byte-for-byte unchanged for prompt-cache stability. Kanban comments now use their own kanban_note() and _drain_pending_kanban_note() path. Comment injection uses unknown when the source has no author rather than calling it an operator.

The branch is rebased on current main. The conflict in agent/agent_runtime_helpers.py was resolved by keeping the current socket-shutdown refactor and placing the Kanban-note delivery helper beside the current /steer helper.

Verification on this head:

• scripts/run_tests.sh tests/tools/test_kanban_comment_injection.py tests/agent/test_steer.py -q: 43 passed
• Current turn-finalizer guard coverage: 25 passed
• ruff check on all touched Python files, py_compile, and git diff --check: passed

No internal file paths, incident references, or forensic narrative are included here or in the commit message.

[steveonjava]

Both red checks are fixed:

• Check contributors / check-attribution: the third commit had picked up an Independent Verifier <verifier@users.noreply.local> author/committer identity (unmapped email, tripped the attribution guard). Amended it to my own identity (steveonjava@gmail.com, already in AUTHOR_MAP) and force-pushed with lease.
• Python tests / Run tests slice 1/12: unrelated flake — test_concurrent_package_builders_commit_one_delta in tests/hermes_cli/test_relay_shared_metrics.py hit sqlite3.OperationalError: database is locked under thread-barrier concurrency. That file isn't touched by this diff; re-running CI cleared it.

All checks green, mergeStateStatus is CLEAN. Marking ready for review.