kanban: fix worker spawn ModuleNotFoundError by setting PYTHONPATH - #144142

Summary

• The launcher (hermes.cmd/hermes.exe) makes hermes_cli importable via an in-process sys.path.insert(0, <hermes-agent root>), after explicitly popping any inherited PYTHONPATH. That only affects the current process.
• The kanban dispatcher spawns every worker as a bare sys.executable -m hermes_cli.main (_module_hermes_argv), bypassing the launcher shim entirely, so the fresh child interpreter can't import hermes_cli and crashes immediately with ModuleNotFoundError: No module named 'hermes_cli'.
• This affects every kanban-dispatched worker on managed-runtime installs, not just custom profiles. Appears to match several independently filed reports of the same symptom: Kanban dispatcher worker spawn: ModuleNotFoundError: No module named 'hermes_cli' on managed-runtime installs #125121, [Bug]: Kanban worker spawn fails with ModuleNotFoundError: No module named 'hermes_cli' when the gateway runs on the PM store Python #122620, Kanban workers crash after hermes update: dispatcher picks '-m hermes_cli.main' from a find_spec probe polluted by the gateway bootstrap sys.path #122500, Windows: kanban workers crash with ModuleNotFoundError when gateway runs from venv (pip console_script launcher fails with restricted PATH) #30943, kanban dispatcher spawns broken workers under managed runtime (python -m hermes_cli.main without sys.path) #134503, kanban dispatcher: worker spawn argv guard checks importability in parent, unsound for bare-interpreter child (ModuleNotFoundError: hermes_cli) #122299, Kanban dispatch spawns workers via sys.executable -m hermes_cli.main, broken under PM-managed runtime #137079, kanban dispatcher worker spawn fails under a bootstrap install: 'sys.executable -m hermes_cli.main' child cannot import hermes_cli #135640, Kanban worker spawn crashes with ModuleNotFoundError: hermes_cli.main (git-checkout installs) #124542.

Fix

Set PYTHONPATH on the worker's environment (right where the rest of the worker env is already built in kanban_db_dispatch.py) to the same root the launcher inserts into sys.path. Deliberately does not change _module_hermes_argv's choice of sys.executable -m hermes_cli.main — that invocation is a documented, deliberate mitigation for a PATH-shadowing attack (#111569), so this adds the missing piece instead of changing it.

Test plan

• Reproduced the crash locally on a Windows managed-runtime install (worker died within 61-82s on every attempt, every time).
• Applied the fix, restarted the gateway, unblocked the same stuck task, ran a manual dispatch pass.
• Confirmed the worker process stayed alive for minutes with real heartbeats and CPU time, well past the point every prior attempt had already crashed, and completed normally.

🤖 Generated with Claude Code