K8: add explicit provider policy selection diagnostics

[arumihsnek]

Summary

K8 product enforcement now fails closed when a worker-scoped Kanban task has no HERMES_KANBAN_PROVIDER_POLICY artifact. The worker CLI raises before provider routing instead of allowing a policy-bound execution to bypass enforcement.

This preserves the existing behavior for malformed, inactive, non-routable, unknown, and disallowed-model routes, while adding an explicit regression for the missing-artifact boundary.

Validation

• python3 -m pytest -q tests/hermes_cli/test_kanban_provider_policy.py tests/hermes_cli/test_kanban_policy_runtime.py — 17 passed.
• Related K8 regression suite on the exact candidate — 77 passed.
• py_compile and git diff --check passed.
• Offline isolated integration observed zero provider calls, protected-value reads, and lifecycle mutations.

Senior gate

• Exact head: 09597eb0f3df7a0f1581f1d65980eb6f2c300a79.
• Product-only codex-senior-consult v3 execution: 02d8dead-3306-4b42-b53a-4f3bfc1d0a61.
• Verdict: accept; safe_to_merge=true; blocking findings: none.
• Configuration dependency: arumihsnek/my-hermes-config#23 is merged as 3b850fe356a4bfd6c9ae466164c8959a9aaf87be, with the accepted config tree verified equivalent to 9acd7893b8f4462a0ccb04c62d62b80d0ad226ef.
• Cross-repository v3 execution: 747e6a7b-9f41-4681-98f2-d9351b958c57 — accept, safe_to_merge=true.

Evidence boundary

The validation is offline/synthetic. No new provider live test was performed and no credentials were read. Historical live evidence remains limited to openai-codex/gpt-5.6-luna; unproven routes remain inactive and non-routable in configuration.

Post-config offline verification passed against the merged configuration tree: policy preflight ready, inactive routes blocked, missing/malformed policy blocked, and provider calls/protected-value reads/lifecycle mutations all zero.