fix(kanban): scope default assignee fallback by board

[0bkevin]

What does this PR do?

Scopes the gateway and CLI kanban.default_assignee fallback to explicitly
authorized Kanban boards.

The machine-wide singleton dispatcher still scans every active board for cards
that already have an explicit assignee. Only the mutating fallback for
otherwise-unassigned Ready cards is restricted.

kanban.default_assignee_boards supports:

• ["default"] — compatibility default
• named board slugs — explicit opt-in
• [] — disable fallback assignment
• ["*"] — deliberately allow fallback on every board

Fallback assignment events now record the responsible dispatcher profile and
the matching routing rule.

Related Issue

Fixes #70805

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)

Changes Made

• Enforce board-scoped fallback routing in gateway dispatch.
• Apply the same policy to direct CLI dispatch.
• Fail closed for malformed board-scope configuration.
• Preserve explicitly assigned cross-board dispatch.
• Add production-path two-profile routing coverage.
• Document configuration and migration behavior.

How to Test

1. Configure two profiles with different default_assignee values and board
   lists.
2. Create unassigned Ready cards on each board.
3. Verify a singleton winner applies its fallback only to authorized boards.
4. Verify explicitly assigned cards continue dispatching on every board.
5. Run the relevant suites through scripts/run_tests.sh.

Validation

• 356 relevant tests passed through the canonical hermetic runner.
• Focused acceptance suite: 26 passed.
• Repository-wide Ruff check passed.
• No new ty diagnostics relative to main.
• Windows portability guard passed across 808 Python files.
• Config validation and drift tests passed.
• Docusaurus diagram lint and production build passed.
• git diff --check and Python bytecode compilation passed.
• Tested on macOS.

Checklist

Code

• I've read the Contributing Guide.
• My commit follows Conventional Commits.
• I searched existing issues and PRs for duplicates.
• The PR contains only changes related to this fix.
• I added regression and production-path tests.

Documentation & Housekeeping

• Updated the Kanban documentation and cli-config.yaml.example.
• Considered Windows, macOS, and Linux behavior.
• No tool schema changes are required.