fix(permissions): give the CEO full authority over every task action

The panel operates as the CEO, but most task-action routes gated to
(assignee | cell_pm/main_pm) and omitted the CEO — so the CEO could approve
(CEO-only routes) yet got 403 ACCESS_DENIED on unblock, block, reassign,
update, delete, cancel. The whole UI write-path was unusable.

can_perform_task_action() now short-circuits true for the CEO (fixes
update/reassign, delete, cancel and anything routed through it), and the
inline block/unblock checks add AgentRole.CEO. The override is a CEO-only
early return, so it cannot affect any other role.

tests/unit/services/test_permissions.py

@@ -153,6 +153,21 @@ def test_cell_pm_can_close_in_own_cell(svc: PermissionService) -> None:
     assert svc.can_perform_task_action(cell_pm, TaskAction.CLOSE, Team.BACKEND) is True
 
 
+def test_ceo_can_perform_any_task_action(svc: PermissionService) -> None:
+    """The CEO is the ultimate authority — it may perform ANY task action on any
+    task (assign/reassign, change priority, close, claim, view). The panel
+    operates as the CEO, so this override is what unblocks the whole UI."""
+    ceo = _ctx(AgentRole.CEO)
+    for action in (
+        TaskAction.ASSIGN,
+        TaskAction.CHANGE_PRIORITY,
+        TaskAction.CLOSE,
+        TaskAction.CLAIM,
+        TaskAction.VIEW_ALL,
+    ):
+        assert svc.can_perform_task_action(ceo, action, Team.BACKEND) is True
+
+
 def test_get_task_actions_returns_set(svc: PermissionService) -> None:
     dev = _ctx(AgentRole.DEVELOPER, team=Team.BACKEND)
     actions = svc.get_task_actions(dev)