Resuming a dispatcher-spawned Kanban worker session from the ordinary
CLI, /resume, /sessions, oneshot or the Desktop gateway would create a
write-capable writer the board cannot observe (and unblocking the card
can dispatch a competing worker into the same workspace).
- hermes_cli/kanban_resume_guard.py: kanban_resume_refusal() refuses a
session whose Kanban ownership markers are present; fails OPEN only
on probe errors. HERMES_KANBAN_TASK (the dispatcher's own env)
exempts the legitimate dispatcher-driven resume.
- SessionDB.is_kanban_owned_session() probes the transcript for the
worker markers without loading history.
- Wired into: CLI --resume/-c (falls back to a fresh session id),
/resume + /sessions (keep current session, print refusal), oneshot
quiet resume, gateway session.resume (error code 4132).
- locales: cli.resume.kanban_owned in en + 16 languages.
- Two latent F811 redefinitions fixed in moved handler code.
Fixes#68779
d53b1720e6