fix(kanban): bind lifecycle handoff to worker claim

[enzo-adami]

Extends NousResearch#85408 without replacing or rebasing the original author's work.

Root cause

The lifecycle tool handler performs the guarded state transition and then calls latest_run() to build its result. A successor can claim the task between those operations, so the old worker can receive the successor's run ID. Separately, the stop latch accepted any successful lifecycle-shaped payload and later stopped on any truthy latch, without checking that both task and run still match the active dispatcher claim.

Changes

• Capture the worker's run ID before each lifecycle transition and use that ID in the successful receipt.
• Latch only receipts whose task and run exactly match the dispatcher-owned environment claim.
• Revalidate and clear the latch before cancelling later tool segments or ending the conversation loop.
• Keep runtime route provenance sourced from the effective agent fields after provider response.
• Add deterministic race, mismatch, missing-run, stale-successor, and runtime-route regressions.

Validation

• Focused suite: 48 passed, 1 skipped.
• Ruff on all changed Python files: pass.
• git diff --check: pass.
• Broader announced suite: 291 passed, 1 skipped; one unrelated environment failure because the borrowed test venv lacks the optional anthropic package (TestAnthropicInterruptHandler). The exact original PR suite had previously passed 284 passed, 1 skipped on its HEAD.

This PR targets the original author's branch so they can cherry-pick or merge the extension while preserving authorship and the existing upstream PR.