fix(kanban): drop unknown per-task skills instead of crashing workers

[terrichan-git]

Bug Description

A Kanban card that pinned skills: the assignee profile did not have spawned hermes --skills <unknown> and crashed on boot with ValueError: Unknown skill(s): ... when every pinned name was missing. The dispatcher retried once, then gave_up / blocked. Desktop kept notifying on the dead card.

This hit an orchestrator card that forced revenueos and human-in-loop-agent-graphs (installed on default, not on orchestrator).

Root Cause

create_task stored the pin list after syntax checks only (commas, toolset-name typos). _default_spawn passed every name through as --skills. Worker preload hard-fails when the loaded set is empty and the missing set is not.

There is still no runtime install. That is correct. The bug is crashing instead of dropping names the profile cannot load.

Fix

• Resolve the assignee's skills/ tree (follows skill-dir symlinks; uses frontmatter name: and the directory name).
• Drop unknown pins at create_task. Record them on the created event as dropped_skills.
• Drop again at _default_spawn so stale rows cannot kill a worker.
• If the assignee profile directory does not exist, leave the pin list alone (review-dispatch / first-time assignees).

How to Verify

1. pytest tests/hermes_cli/test_kanban_core_functionality.py tests/hermes_cli/test_kanban_review_lifecycle.py tests/hermes_cli/test_kanban_db.py -q
2. Create a task assigned to a profile that exists and pin a skill it does not have. The stored skills list should omit it; created payload should list dropped_skills.
3. Confirm a review-dispatch task that pins a skill without planting a profile dir still keeps the pin (existing test).

Test Plan

• Added regression tests: drop unknown, keep when no catalog, symlink install, spawn argv filter
• Existing kanban tests still pass (76 passed, 2 skipped)
• Manual: hermes -p orchestrator skills list after symlink install of conductor skills (local profile change, not in this PR)

Risk Assessment

Low — only changes per-task --skills argv. Workers with no pins are unchanged. Worst case for a typo is a worker that boots without the intended skill (and a warning / dropped_skills event) instead of a crash loop.

[alt-glitch]

This was generated by AI during triage.

Related to #30025 and #44101: this covers the same profile-scoped skill-resolvability failure, combining spawn-time protection with create-time filtering. The approaches overlap but have a concrete scope difference; maintainers should choose or consolidate.