fix(kanban): nudge workers that exit without complete/block

Add a bounded turn-end stop guard for kanban workers. When a worker
tries to exit with finish_reason=stop without having called
kanban_complete or kanban_block, inject up to two synthetic nudges
so the conversation loop continues instead of exiting cleanly (which
the dispatcher records as protocol_violation).

Mirrors the existing verify-on-stop pattern: same ephemeral scaffolding
flag (_kanban_stop_synthetic), same role-alternation contract, same
_pending_verification_response fallback for budget exhaustion.

Disabled by default (gated on HERMES_KANBAN_TASK env var set by the
dispatcher); kill switch via HERMES_KANBAN_STOP_NUDGE=0.

Salvaged from #62262 by @mdc2122. The original branch was 272 commits
behind main with ~538 files of stale-base reversions; this salvage
applies only the 4 substantive files (agent/kanban_stop.py,
conversation_loop.py insertion, run_agent.py _EPHEMERAL_SCAFFOLDING_FLAGS,
tests/agent/test_kanban_stop.py).

tests/agent/test_kanban_stop.py

@@ -0,0 +1,95 @@
+"""Tests for the kanban worker turn-end stop guard."""
+
+from __future__ import annotations
+
+import pytest
+
+from agent.kanban_stop import (
+    build_kanban_stop_nudge,
+    kanban_stop_nudge_enabled,
+    session_called_kanban_terminal,
+)
+
+
+@pytest.fixture
+def clear_kanban_env(monkeypatch):
+    for var in ("HERMES_KANBAN_TASK", "HERMES_KANBAN_STOP_NUDGE"):
+        monkeypatch.delenv(var, raising=False)
+    return monkeypatch
+
+
+def test_disabled_without_kanban_task(clear_kanban_env):
+    assert kanban_stop_nudge_enabled() is False
+    assert build_kanban_stop_nudge(messages=[]) is None
+
+
+def test_enabled_with_kanban_task(clear_kanban_env):
+    clear_kanban_env.setenv("HERMES_KANBAN_TASK", "t_abc")
+    assert kanban_stop_nudge_enabled() is True
+
+
+def test_env_can_disable(clear_kanban_env):
+    clear_kanban_env.setenv("HERMES_KANBAN_TASK", "t_abc")
+    clear_kanban_env.setenv("HERMES_KANBAN_STOP_NUDGE", "0")
+    assert kanban_stop_nudge_enabled() is False
+    assert build_kanban_stop_nudge(messages=[]) is None
+
+
+def test_nudge_when_no_terminal_tool(clear_kanban_env):
+    clear_kanban_env.setenv("HERMES_KANBAN_TASK", "t_46be8aa5")
+    messages = [
+        {"role": "user", "content": "work kanban task"},
+        {
+            "role": "assistant",
+            "content": "Let me write the comprehensive recipe.",
+            "tool_calls": [
+                {
+                    "id": "1",
+                    "type": "function",
+                    "function": {"name": "kanban_heartbeat", "arguments": "{}"},
+                }
+            ],
+        },
+        {"role": "tool", "name": "kanban_heartbeat", "tool_call_id": "1", "content": "ok"},
+    ]
+    nudge = build_kanban_stop_nudge(messages=messages, attempts=0)
+    assert nudge is not None
+    assert "kanban_complete" in nudge
+    assert "kanban_block" in nudge
+    assert "t_46be8aa5" in nudge
+    assert "protocol violation" in nudge.lower() or "protocol" in nudge.lower()
+
+
+def test_no_nudge_after_kanban_complete(clear_kanban_env):
+    clear_kanban_env.setenv("HERMES_KANBAN_TASK", "t_abc")
+    messages = [
+        {
+            "role": "assistant",
+            "content": "",
+            "tool_calls": [
+                {
+                    "id": "1",
+                    "type": "function",
+                    "function": {"name": "kanban_complete", "arguments": "{}"},
+                }
+            ],
+        },
+        {"role": "tool", "name": "kanban_complete", "tool_call_id": "1", "content": "done"},
+    ]
+    assert session_called_kanban_terminal(messages) is True
+    assert build_kanban_stop_nudge(messages=messages) is None
+
+
+def test_no_nudge_after_kanban_block(clear_kanban_env):
+    clear_kanban_env.setenv("HERMES_KANBAN_TASK", "t_abc")
+    messages = [
+        {"role": "tool", "name": "kanban_block", "tool_call_id": "1", "content": "blocked"},
+    ]
+    assert build_kanban_stop_nudge(messages=messages) is None
+
+
+def test_nudge_budget_exhausted(clear_kanban_env):
+    clear_kanban_env.setenv("HERMES_KANBAN_TASK", "t_abc")
+    assert build_kanban_stop_nudge(messages=[], attempts=2) is None
+    assert build_kanban_stop_nudge(messages=[], attempts=1, max_attempts=1) is None
+    assert build_kanban_stop_nudge(messages=[], attempts=0, max_attempts=1) is not None