The panel operates as the CEO, but most task-action routes gated to
(assignee | cell_pm/main_pm) and omitted the CEO — so the CEO could approve
(CEO-only routes) yet got 403 ACCESS_DENIED on unblock, block, reassign,
update, delete, cancel. The whole UI write-path was unusable.
can_perform_task_action() now short-circuits true for the CEO (fixes
update/reassign, delete, cancel and anything routed through it), and the
inline block/unblock checks add AgentRole.CEO. The override is a CEO-only
early return, so it cannot affect any other role.
Renn F
f3e4f8aeb7