fix(overseer): converge P2 verify-and-merge escalation (#4344, #4145)

[rysweet]

Summary

Makes the overseer's P2 verify-and-merge escalation converge: an unchanged, still-blocked PR is now escalated once and then suppressed on subsequent ticks (via a BackoffGate), instead of re-paging the operator every tick. Fixes the non-convergence defect observed on rysweet/Simard#4344 and #4145, where the same "escalated to operator: verify-and-merge" line re-fired continuously without a concrete blocker.

What changed

• Convergence logic (src/overseer/mod.rs): per-PR escalation state keyed on {repo}#{pr}, tracked in merge_escalation_gate (backoff) + merge_escalation_blocker (last-seen blocker class). Re-pages only when the blocker class changes or the backoff window elapses; a successful merge neither escalates nor writes the gate. O(1) per tick per PR.
• Sanitizer dedupe (3a1d8183): replaced the bespoke sanitize_blocker_detail with the shared, hardened signal::sanitize_detail, adding ANSI stripping + token-shaped-secret redaction to escalation logs (closes a potential token-leak path when a merge-judge reason carries a credential). Behavior otherwise preserved.
• Docs: new docs/reference/overseer-merge-escalation-convergence.md (design + defect writeup), overseer design/API reference updates, wired into mkdocs.yml.

Testing

• cargo fmt --all -- --check — clean
• cargo clippy --all-targets --all-features --locked -- -D warnings — clean
• 7/7 new convergence tests, 589/589 overseer suite, race-subset release tests — all green (pre-push gate passed)

Notes / out of scope

• N1 — unbounded gate-map growth: consistent with every existing gate (coverage_backoff, blocked_goal_gate); bounded by real PR volume. Shared-infra change deferred to a separate PR.
• Scope is intentionally P2-only (serialized P2→P1→P3 to avoid mod.rs field/gate collisions).

Refs #4344, #4145

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[github-actions]

📊 Coverage Summary

Generated by cargo llvm-cov --workspace --summary-only (nightly, excluding test files)

Module	Lines	Covered	Coverage
Total	187763	157254	83.8%

_{Coverage data from CI run. Test files matching tests?/ are excluded from line counts.}