Fix #255: Add escalated state field to enforce NoRestartAfterEscalation invariant

[AlexMikhalev]

Implements the TLA+ Escalate action in the Rust supervisor.

• Adds escalated: bool to AgentSupervisor
• Sets escalated = true when should_restart() detects max restarts exceeded
• Guards all restart actions with !self.escalated
• Adds is_escalated() getter
• Includes 4 unit tests covering escalation and the NoRestartAfterEscalation invariant

Refs #255