fix: feat: unified escalation — single PHASE:escalate path for all agents (#510)

Replace PHASE:needs_human with PHASE:escalate across all agent types.
Consolidates 6 overlapping escalation mechanisms into one unified path:
detect → notify via Matrix → session stays alive → human reply injected → resume.

Key changes:
- PHASE:escalate replaces PHASE:needs_human everywhere (16 files)
- CI exhausted now escalates instead of immediately marking blocked
- Matrix listener routes free-text replies to vault tmux sessions
- Vault agent writes PHASE:escalate files for procurement requests
- Supervisor monitors PHASE:escalate sessions in health checks
- 24h timeout on escalation → blocked label + session killed
- All 38 phase protocol tests updated and passing

Supersedes #462, #458, #465.

lib/agent-session.sh

@@ -330,7 +330,7 @@ monitor_phase_loop() {
       local current_phase
       current_phase=$(head -1 "$phase_file" 2>/dev/null | tr -d '[:space:]' || true)
       case "$current_phase" in
-        PHASE:done|PHASE:failed|PHASE:merged|PHASE:needs_human)
+        PHASE:done|PHASE:failed|PHASE:merged|PHASE:escalate)
           ;; # terminal — fall through to phase handler
         *)
           # Call callback with "crashed" — let agent-specific code handle recovery
@@ -410,7 +410,7 @@ monitor_phase_loop() {
         fi
         return 0
         ;;
-      PHASE:failed|PHASE:needs_human)
+      PHASE:failed|PHASE:escalate)
         _MONITOR_LOOP_EXIT="$current_phase"
         if type "${callback}" &>/dev/null; then
           "$callback" "$current_phase"