Close residual gaps: CEO escalation from blocked, ref repair, reset-script state

Three independent residual hardenings surfaced by the smoke run:

- escalate_to_ceo is now reachable from a blocked task (source widened to
  {awaiting_pm_review, blocked} with a matching status-transition row), so a
  main_pm or board agent has a clean verb to surface a task it cannot resolve
  to the CEO — who can then approve, reject, or cancel it. Regenerated the
  lifecycle artifacts (status-transitions doc + panel JSON) to match.

- WorkspaceService now prunes broken loose refs (.bak debris and any ref whose
  contents are neither an object id nor a symref) before the refresh fetch, so
  a ref left corrupt by an interrupted recovery no longer produces per-operation
  "broken ref" warnings or wedges ref enumeration. Best-effort, file-reads-only.

- The reset script's full-reset Claude-state clear now defaults to the
  replay-state subdirs (projects/, todos/) of the mounted Claude home and
  refuses to clear the home root, so a full reset actually clears conversation
  replay state by default without wiping the host's stored credentials.

docs/rag/lifecycle/status-transitions.md

@@ -17,6 +17,7 @@
 | awaiting_qa | needs_revision | qa_fail | qa |
 | backlog | cancelled | cancel | cell_pm, ceo, main_pm |
 | backlog | pending | activate | any |
+| blocked | awaiting_ceo_approval | escalate_to_ceo | head_marketing, main_pm, product_owner |
 | blocked | cancelled | cancel | cell_pm, ceo, main_pm |
 | blocked | in_progress | unblock | any |
 | blocked | pending | unblock | any |