feat(kanban): 1:1 port of Hermes multi-agent kanban board

[kleopasevan]

Summary

Adds a durable SQLite-backed multi-agent task board to rantaiclaw at v1 feature parity with Hermes kanban — every CLI verb, slash verb, and kanban_* agent tool maps 1:1 so existing playbooks transfer without rewrites.

This is the engineering primitive Hermes calls "the shape that covers the workloads delegate_task can't": research triage, scheduled ops, digital twins, engineering pipelines, fleet farming. Tasks are SQLite rows, handoffs are SQLite rows, and every worker is a full process with its own identity.

What ships

• Storage kernel (src/kanban/) — schema (tasks, task_links, task_comments, task_events, task_runs, kanban_notify_subs) byte-compatible with Hermes v1; WAL + BEGIN IMMEDIATE + CAS UPDATEs; multi-board (per-project) isolation; runs attempt history with structured handoff; gateway notify-subscribe table; triage specifier; in-process dispatcher loop with set_spawner extension point.
• CLI (rantaiclaw kanban …) — init, create, list, show, assign, link, unlink, claim, comment, complete, block, unblock, archive, tail, watch, heartbeat, runs, dispatch, stats, context, specify, assignees, notify-{subscribe,list,unsubscribe}, boards {list,create,switch,show,rename,rm}, and the --board <slug> one-shot scope flag.
• Slash (/kanban … in TUI) — same clap subcommand tree as the CLI; output captured into a writer so any channel adapter can deliver it as a message.
• 9 agent tools (kanban_show, kanban_list, kanban_complete, kanban_block, kanban_heartbeat, kanban_comment, kanban_create, kanban_link, kanban_unblock) — env-gated availability (RANTAICLAW_KANBAN_TASK for workers, RANTAICLAW_KANBAN_ORCHESTRATOR for orchestrators) so non-kanban sessions see zero tool bloat.
• Docs — docs/kanban.md user guide, docs/kanban/skills/{kanban-worker,kanban-orchestrator}.md pattern docs, docs/superpowers/specs/2026-05-16-kanban-port-design.md design rationale.

Non-goals (called out explicitly in spec + user guide)

• React/web dashboard. Rantaiclaw has no web-dashboard subsystem yet; the REST shape is reserved for when one lands.
• Auxiliary-LLM-driven specify. Ships with a deterministic template; auxiliary-provider wire-up is a follow-up that doesn't touch the CLI surface.
• Workspace subprocess spawning. Schema persists workspace_kind / workspace_path and the dispatcher exposes the env vars; the actual worker spawn is a Dispatcher::set_spawner(|task_id| { … }) away once the team picks the worker model.

Risk + rollback

• Blast radius: one new top-level module (src/kanban/), one new clap subtree, 9 tool registrations, 1 TUI slash handler. No edits to existing critical paths (gateway / security / agent loop).
• Storage: writes only to $RANTAICLAW_HOME/kanban.db (default ~/.rantaiclaw/kanban.db) and ~/.rantaiclaw/kanban/. Revert + delete those paths to fully roll back.
• Migration: schema is purely additive on first connect. No pre-existing user data is mutated.

Verification

cargo check --lib                       # clean
cargo check --bin rantaiclaw            # clean
cargo test --lib kanban                 # 27 passed; 0 failed
cargo clippy --lib --no-deps            # 0 errors (style nags only; on par with existing repo)

Full-crate cargo test deliberately not run locally — it OOMs the dev box (matrix-sdk, wa-rs, all features). CI will exercise it.

Test plan

• Reviewer runs rantaiclaw kanban init then rantaiclaw kanban create \"test\" --assignee me, confirms ~/.rantaiclaw/kanban.db exists with a task row.
• Reviewer runs rantaiclaw kanban boards create alpha --switch then rantaiclaw kanban list — confirms isolation from default.
• Reviewer runs rantaiclaw kanban dispatch on a ready task — confirms it claims (status → running) without a spawner.
• Reviewer runs /kanban list from the TUI — confirms slash output matches CLI.
• Reviewer reads docs/kanban.md and docs/superpowers/specs/2026-05-16-kanban-port-design.md.

🤖 Generated with Claude Code

[github-actions]

PR intake checks found warnings (non-blocking)

Fast safe checks found advisory issues. CI lint/test/build gates still enforce merge quality.

• Missing required PR template sections: ## Validation Evidence (required), ## Security Impact (required), ## Privacy and Data Hygiene (required), ## Rollback Plan (required)
• Incomplete required PR template fields: summary problem, summary why it matters, summary what changed, validation commands, security risk/mitigation, privacy status, rollback plan

Action items:

1. Complete required PR template sections/fields.
2. Remove tabs, trailing whitespace, and merge conflict markers from added lines.
3. Re-run local checks before pushing:
   • ./scripts/ci/rust_quality_gate.sh
   • ./scripts/ci/rust_strict_delta_gate.sh
   • ./scripts/ci/docs_quality_gate.sh

Run logs: https://github.com/RantAI-dev/RantAIClaw/actions/runs/25967917731

Detected blocking line issues (sample):

• none

Detected advisory line issues (sample):

• none