fix(kanban): use one-shot worker launch nonces

[benperry6]

Follow-up for NousResearch#92416.

This replaces query-text recognition with a one-shot native launch proof:

• _default_spawn mints a fresh secrets.token_urlsafe(32) nonce per launch;
• the same nonce is carried in the worker env and hidden CLI argument;
• startup requires source kanban, a task ID, and exact nonce equality;
• the env nonce is consumed immediately;
• reconstructing both positions from the public task ID fails;
• import failure remains fail-closed while board/database routing is preserved.

This prevents accidental/passive lifecycle inheritance. It is deliberately not described as cryptographic authentication against a malicious same-user process that can inspect process launch state.

Evidence:

• final relevant matrix: 39 passed, 0 failed
• repository-wide ownership-key scan: 7 locations, 0 missing marker
• Ruff, compileall, and git diff --check: clean

Parent is the exact current source-branch head 7fabbc59d9a50c1d12be5bfd4ff9a633db64e734.

[benperry6]

Superseded by a fresh, standalone current-main commit:

benperry6@a3f1465

The refreshed implementation is based on upstream cbd8de8ad64530be01efea23b7764d5c37c634ed and keeps the one-shot nonce contract without asking this older author branch to absorb unrelated mainline history. Closing this follow-up to keep one current implementation reference.