🐛 fix(kanban): reaper clears stale claims on dead workers in non-running lanes

[cwest]

Summary

A worker can die or be killed while its kanban card sits in a non-running
lane — most commonly review, after the implementer opened a PR and the card
moved on. The dead worker leaves claim_lock + worker_pid populated, and the
review-column dispatch query gates on claim_lock IS NULL, so the next worker
(the reviewer) cannot spawn until the 1h stale-claim TTL in
release_stale_claims eventually frees it. The lane wedges in the meantime.

Root cause

detect_crashed_workers scanned only WHERE t.status = 'running' and its
release UPDATE was guarded status = 'running'. A dead worker whose card had
already moved to review (or any non-running lane) was invisible to the fast
reaper — it never inspected the card, never cleared the stale lock. The TTL was
the only path that ever freed it. The reaper already keys liveness on
worker_pid (correct), but the status filter excluded the card before that
check ran.

Fix

Widen the scan to any card with a non-NULL worker_pid (status added to the
projection). After the existing host-local, launch-grace, and dead-PID checks
pass, branch on status:

• non-running card → clear the dead claim in place
  (claim_lock/claim_expires/worker_pid = NULL) with a
  stale_claim_cleared event and no lane change — a dead worker in review
  stays in review so the reviewer re-spawns, rather than being yanked back to
  ready. No run is opened/closed, no crashed event is emitted, and the
  failure counter / circuit breaker is not touched (those are running-crash
  semantics).
• running card → unchanged. The crash/requeue/breaker machinery runs
  exactly as before; its UPDATE stays guarded status = 'running' and only ever
  fires for running cards (non-running ones continue out above).

Launch-grace (measured from the active task_runs row) and the host-local claim
check still apply, so a freshly-spawned worker is not reaped mid-init and a
foreign-host claim is left alone.

Tests

4 new regression tests in tests/hermes_cli/test_kanban_db.py, E2E-style
against a temp HERMES_HOME with the real kanban_db import:

• dead host-local worker_pid on a review card → claim cleared, status stays
  review, no failure counted;
• after the clear, the card matches the review-dispatch query (fresh spawn
  permitted);
• a within-launch-grace claim on a review card is not cleared;
• a foreign-host claim on a review card is left untouched.

Full tests/hermes_cli/test_kanban_db.py green (230 passed); the 35
crash/reaper/stale/grace/rate-limit tests — including the breaker-trip and
systemic-block paths — confirm the running-crash semantics are unchanged.

Scope

Single-file change in hermes_cli/kanban_db.py + tests + a PATCHES.md
upstream-pending row. A reaper that ignores non-running lanes is a general
dispatcher bug, not homestead-specific — a clean upstream candidate.

[cwest]

The fix lands where the wedge actually was. detect_crashed_workers only ever looked at running cards, so a dead worker whose card had already moved to review sat there holding claim_lock until the 1h TTL — and the review-column dispatch gates on claim_lock IS NULL, so no reviewer could spawn in the meantime. Widening the scan to any non-NULL worker_pid and branching on status is the right shape.

The branch ordering is correct: host-local, launch-grace, and dead-PID checks all run before the new code, so a freshly-spawned worker still gets its grace window and a foreign-host claim is left alone. The non-running clear sits behind a continue, so it never reaches the run open/close, the crashed event, or the failure-counter and breaker — those stay running-only. The running path's UPDATE is unchanged, still guarded on status = 'running'.

The in-place UPDATE is guarded on id, status, and worker_pid together, so if the row moved between the SELECT and the UPDATE the rowcount won't be 1 and no stale_claim_cleared event fires. No lane change means a dead worker in review stays in review and the reviewer re-spawns instead of getting yanked back to ready.

Verified by running the suite in a throwaway clone at the head commit: the four new tests pass and the full tests/hermes_cli/test_kanban_db.py is 230 passed. ruff is clean on both changed files. mergeable is MERGEABLE, every check is success, and there are no unresolved threads.

No changes needed.