Add escalation-path v1 and trust transform fields

[TacoRocket]

What changed

• added chains escalation-path as a narrow v1 chain family focused on current-foothold direct control
• upgraded shared chain semantics and table rendering with urgency and a family-specific escalation-path view
• upgraded privesc into clearer current-foothold triage with starting_foothold, proof/missing-proof wording, and next-review guidance
• added hidden transform-level backend fields to role-trusts so future trust-backed escalation rows can carry exact mechanism data without bloating the current table
• updated fixtures, goldens, and tests for the new chain and trust-field contract

Why it changed

AzureFox needed a truthful escalation chain family that behaves more like deployment-path and less like a restatement of privileged posture. This slice ships the defended direct-control row now, while laying the backend groundwork for later trust-expansion rows that only graduate when the exact transform is explicit.

User and developer impact

• operators can now run azurefox chains escalation-path and get a defended current-foothold escalation story instead of stitching it together manually from privesc and permissions
• privesc now reads more clearly as triage rooted in the current foothold
• role-trusts JSON now carries hidden transform fields such as control primitive, controlled object, escalation mechanism, usable identity result, and defender cut point for future chain use
• trust-backed escalation rows are still intentionally suppressed from escalation-path unless the transform is explicit and target-side control is confirmed

Root cause

The repo had stronger chaining expectations after deployment-path, but the identity/escalation surfaces were still too relationship-first. That made it hard to answer the real chain question: what exact transform moves the foothold into stronger control, and what edge would a defender cut to stop it?

Validation

• python3 -m pytest tests/test_chain_semantics.py tests/test_cli_smoke.py tests/test_collectors.py tests/test_terminal_ux.py tests/test_contract_schemas.py
• python3 -m pytest
• CCR follow-up review: no implementation-vs-plan drift found