Fix hera plan-DAG hygiene: orphaned planned nodes + silent materialize retry

[anutron]

Summary

Three independently-verified hera plan-DAG / rail data-hygiene bugs were found live in ~/.argus/data.sql. This PR fixes the two genuine code defects and documents why the third is data-hygiene only.

• Bug A — heragater polled planned nodes forever after their orchestrator was archived/nuked (ListHeraPlannedNodes never checked the parent). Fixed with a belt-and-braces pair: ArchiveHeraOrchestrator/NukeHeraOrchestrator now cascade-cancel still-planned child roles, and ListHeraPlannedNodes also joins hera_orchestrators to exclude nodes under an ended orchestrator regardless of cause — retroactive, no data migration needed for the code fix itself.
• Bug B — materializeNode retried a permanently-broken planned node (e.g. blank argus_project) in total silence, forever. Fixed with a bounded consecutive-failure counter that escalates to the coordinator exactly once, mirroring holdAndPing's ping-once dedup shape. Never auto-cancels or reconfigures the node — advisory only.
• Bug C — two freelance roles render as orphaned in the rail's flat Freelance section despite an intact data chain. Confirmed data-hygiene (nobody archived them once their work finished), not a display defect — no code change; see design.md.

OpenSpec change fix-hera-plan-dag-hygiene is archived in this PR (deltas merged into openspec/specs/task-orchestration/spec.md).

Part 2 (retroactive DB cleanup) — BLOCKED, needs host execution

The task also asked for a one-shot cleanup of the specific broken rows already in the live ~/.argus/data.sql (cancel planned nodes 343/358, archive freelance roles 813/814, close bindings 803/804 — node 184 intentionally untouched, see the open question below).

This hera worker's sandbox has no write access outside its own worktree — confirmed via EPERM on every attempt, including a plain touch ~/.argus/_probe.tmp, not just the DB write itself. There is no MCP tool (iris/hera/plannotator) that exposes generic host file/DB access for this. This is a hard, correct security boundary (worker isolation), not something to route around.

A ready-to-run, backup-first migration snippet using only pre-existing internal/db store methods (CancelHeraPlannedNode, ArchiveHeraRole, EndHeraBinding — works against current master, no dependency on this branch) has been handed to the coordinator for someone with host access (Aaron) to run. See hera_send for the snippet and exact steps.

Test plan

• internal/db/hera_plan_test.go: planned node under an archived/nuked orchestrator excluded from ListHeraPlannedNodes, including when the node itself carries no cancelled_at.
• internal/db/hera_test.go: archiving/nuking cascades cancelled_at to still-planned children; a materialized (bound) child is untouched; an already-archived/cancelled child is left as-is.
• internal/heragater/heragater_test.go: under-threshold silence, one-time escalation notice at the threshold, no repeat notice, counter/escalation-state clears on success, sweep on node removal.
• make pre-pr: build/vet/fmt-check/lint-pr clean; vuln gate stdlib-only (advisory, CI continue-on-error); test-cover-gate 88.7% filtered (floor 88%) — the two internal/agent profile-env test failures are the documented pre-existing hera-worker-sandbox env-contamination artifact (unrelated package, confirmed via go run ./scripts/coverfilter against the run's own coverage.out).

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

[github-actions]

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/drn/argus/internal/db	89.55% (ø)
github.com/drn/argus/internal/heragater	87.58% (ø)

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/drn/argus/internal/db/hera.go	88.04% (ø)	560	493	67
github.com/drn/argus/internal/db/hera_plan.go	84.00% (ø)	175	147	28
github.com/drn/argus/internal/heragater/heragater.go	87.58% (ø)	306	268	38

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• github.com/drn/argus/internal/db/hera_plan_test.go
• github.com/drn/argus/internal/db/hera_test.go
• github.com/drn/argus/internal/heragater/heragater_test.go