fix: feat: unified escalation — single PHASE:escalate path for all agents (#510)

Replace PHASE:needs_human with PHASE:escalate across all agent types.
Consolidates 6 overlapping escalation mechanisms into one unified path:
detect → notify via Matrix → session stays alive → human reply injected → resume.

Key changes:
- PHASE:escalate replaces PHASE:needs_human everywhere (16 files)
- CI exhausted now escalates instead of immediately marking blocked
- Matrix listener routes free-text replies to vault tmux sessions
- Vault agent writes PHASE:escalate files for procurement requests
- Supervisor monitors PHASE:escalate sessions in health checks
- 24h timeout on escalation → blocked label + session killed
- All 38 phase protocol tests updated and passing

Supersedes #462, #458, #465.

action/action-agent.sh

@@ -351,7 +351,7 @@ case "${_MONITOR_LOOP_EXIT:-}" in
     notify_ctx \
       "session idle for $((IDLE_TIMEOUT / 3600))h — killed" \
       "session idle for $((IDLE_TIMEOUT / 3600))h — killed"
-    # Post diagnostic comment + label blocked (replaces escalation JSONL)
+    # Post diagnostic comment + label blocked
     post_blocked_diagnostic "idle_timeout"
     rm -f "$PHASE_FILE" "${PHASE_FILE%.phase}.context" "$IMPL_SUMMARY_FILE" "$THREAD_FILE" "$SCRATCH_FILE"
     ;;