Rewire a live trigger for tier escalation (decideEscalation has no caller since the Cut) #4512

Problem

tiered_execution.escalation (enabled, retries_at_tier, max_promotions) is validated and shown in Settings › Tiered Execution, but nothing fires it. The Cut deleted both triggers: the supervisor-blocked route tiered-inspect-escalation and the verification-failure path (docs/THE-CUT.md rows 131-132, "dropped — tiered execution escalation tied to the deleted inspection/patrol machinery"). PAN-4014 then deleted the dead decideEscalation engine and the recordTierPromotion writer.

Today only the read side survives: readTierOverrides (src/lib/xbrief/io.ts) feeds resolveStaffing (src/lib/agents/staffing.ts), so a tierOverrides entry written by hand in the workspace .pan/continue.json still re-staffs an item. No code writes one.

PAN-4257 restores a pure decideEscalation (with an effort_first option that raises effort one level before promoting the model) and a pure applyEscalationAction that returns the next TierOverridesMap. It does not wire a trigger.

Scope

• Choose the trigger or triggers that call decideEscalation (for example a red verification gate attributed to a slot item, or a blocked supervisor verdict), with the current attempt count at the item's effective difficulty.
• Persist the result: write tierOverrides (and the per-difficulty retry count) to the workspace continue file through the existing continue-state writer.
• Re-dispatch the item so the next slot launch staffs at the new effort or tier.
• Until this lands, Settings and docs must not imply escalation runs automatically.

Blocked by #4257.