Summary

• terminate host-local kanban workers during stale and manual reclaim before returning the task to ready
• guard reclaim updates on the previous claim lock so a late worker cannot be overwritten after reclaim waits for shutdown
• add reclaim coverage for stale-claim and manual-reclaim cancellation paths

Root Cause

Reclaim only cleared the kanban row state. When a task was reclaimed because its lock went stale, or an operator reclaimed it manually, the original worker process kept running. That let the dispatcher spawn a replacement while the old worker was still executing out of band.

Fixes #21141.

Testing

• /Users/leongong/Desktop/LeonProjects/gho_workspace/hermes-agent/.venv/bin/python -m pytest -o addopts='' tests/hermes_cli/test_kanban_db.py -k 'stale_claim_reclaimed or max_runtime_uses_current_run_start_after_retry'
• /Users/leongong/Desktop/LeonProjects/gho_workspace/hermes-agent/.venv/bin/python -m pytest -o addopts='' tests/hermes_cli/test_kanban_core_functionality.py -k 'reclaim_task or stale_run_cannot or enforce_max_runtime'
• /Users/leongong/Desktop/LeonProjects/gho_workspace/hermes-agent/.venv/bin/python -m py_compile hermes_cli/kanban_db.py tests/hermes_cli/test_kanban_db.py tests/hermes_cli/test_kanban_core_functionality.py
• git diff --check