fix: feat: unified escalation — single PHASE:escalate path for all agents (#510)

Replace PHASE:needs_human with PHASE:escalate across all agent types.
Consolidates 6 overlapping escalation mechanisms into one unified path:
detect → notify via Matrix → session stays alive → human reply injected → resume.

Key changes:
- PHASE:escalate replaces PHASE:needs_human everywhere (16 files)
- CI exhausted now escalates instead of immediately marking blocked
- Matrix listener routes free-text replies to vault tmux sessions
- Vault agent writes PHASE:escalate files for procurement requests
- Supervisor monitors PHASE:escalate sessions in health checks
- 24h timeout on escalation → blocked label + session killed
- All 38 phase protocol tests updated and passing

Supersedes #462, #458, #465.

vault/vault-agent.sh

@@ -71,8 +71,13 @@ ${ACTIONS_BATCH}
 - vault-reject.sh: bash ${VAULT_DIR}/vault-reject.sh <action-id> \"<reason>\"
 - matrix_send is available after: source ${FACTORY_ROOT}/lib/env.sh
 
-Process each action now. For auto-approve, fire immediately. For escalate,
-send Matrix message and mark as escalated. For reject, call vault-reject.sh."
+Process each action now. For auto-approve, fire immediately. For reject, call vault-reject.sh.
+
+For actions that need human approval (escalate), write a PHASE:escalate file
+to signal the unified escalation path:
+  printf 'PHASE:escalate\nReason: vault procurement — %s\n' '<action summary>' \\
+    > /tmp/vault-escalate-<action-id>.phase
+Then send a Matrix message with context about what needs approval."
 
 CLAUDE_OUTPUT=$(timeout "$CLAUDE_TIMEOUT" claude -p "$PROMPT" \
   --model sonnet \