Close residual gaps: CEO escalation from blocked, ref repair, reset-script state

Three independent residual hardenings surfaced by the smoke run:

- escalate_to_ceo is now reachable from a blocked task (source widened to
  {awaiting_pm_review, blocked} with a matching status-transition row), so a
  main_pm or board agent has a clean verb to surface a task it cannot resolve
  to the CEO — who can then approve, reject, or cancel it. Regenerated the
  lifecycle artifacts (status-transitions doc + panel JSON) to match.

- WorkspaceService now prunes broken loose refs (.bak debris and any ref whose
  contents are neither an object id nor a symref) before the refresh fetch, so
  a ref left corrupt by an interrupted recovery no longer produces per-operation
  "broken ref" warnings or wedges ref enumeration. Best-effort, file-reads-only.

- The reset script's full-reset Claude-state clear now defaults to the
  replay-state subdirs (projects/, todos/) of the mounted Claude home and
  refuses to clear the home root, so a full reset actually clears conversation
  replay state by default without wiping the host's stored credentials.

panel/lib/lifecycle.json

@@ -456,6 +456,16 @@
       "source": "backlog",
       "target": "pending"
     },
+    {
+      "action": "escalate_to_ceo",
+      "roles": [
+        "head_marketing",
+        "main_pm",
+        "product_owner"
+      ],
+      "source": "blocked",
+      "target": "awaiting_ceo_approval"
+    },
     {
       "action": "cancel",
       "roles": [