fix(gateway): add escalate_to_ceo endpoint + unblock to main_pm role

Smoke surfaced: main-pm hit 404 on /api/v2/flow/main_pm/escalate_to_ceo and /i_am_blocked. role_config promised neither escalate_to_ceo nor unblock for main_pm; the router exposed unblock but not escalate_to_ceo. Aligned both: role_config now lists triage_all/unblock/complete/escalate_up/escalate_to_ceo/i_am_idle, and the router has the matching escalate_to_ceo endpoint.

Note: i_am_blocked stays absent (PMs don't get blocked, they unblock others) — agent hallucinated it from the unscoped MCP tool list. Tightening MCP visibility to the manifest is a separate followup.

roboco/api/routes/v2/flow_main_pm.py

@@ -8,6 +8,7 @@ from fastapi import APIRouter, Depends, Header
 from roboco.api.deps import get_choreographer
 from roboco.api.schemas.v2.flow import (
     CompleteRequest,
+    EscalateToCeoRequest,
     EscalateUpRequest,
     IAmIdleRequest,
     TriageRequest,
@@ -52,6 +53,16 @@ async def escalate_up(
     return env.as_dict()
 
 
+@router.post("/escalate_to_ceo")
+async def escalate_to_ceo(
+    body: EscalateToCeoRequest,
+    x_agent_id: _AgentIdHeader,
+    choreographer: _ChoreographerDep,
+) -> dict:
+    env = await choreographer.escalate_to_ceo(x_agent_id, body.task_id, body.reason)
+    return env.as_dict()
+
+
 @router.post("/unblock")
 async def unblock(
     body: UnblockRequest,

roboco/services/gateway/role_config.py

@@ -60,8 +60,10 @@ _CELL_PM_DO = ("note", "say", "dm", "evidence")
 
 _MAIN_PM_FLOW = (
     "triage_all",
+    "unblock",
     "complete",
     "escalate_up",
+    "escalate_to_ceo",
     "i_am_idle",
 )
 _MAIN_PM_DO = ("note", "say", "dm", "evidence")