Close out escalation and privesc contract cleanup

[TacoRocket]

Summary

• finish the current escalation-path rehab wave, including app-permission reach, service-surface review follow-through, and stronger-control-first ranking
• close out the carried-forward privesc and escalation-path contract cleanup, including clearer privesc path taxonomy, operator-facing table cleanup, and escalation-path note/contract alignment
• replace the README Operator Workflow code block with the shipped demo GIF and update tests/fixtures for the new behavior

Validation

• python3 -m pytest tests/test_chain_semantics.py -q
• python3 -m pytest tests/test_cli_smoke.py -q
• python3 -m pytest tests/test_collectors.py -q -k privesc
• python3 -m pytest tests/test_models.py -q -k privesc
• python3 -m pytest tests/test_terminal_ux.py -q -k privesc
• repo pre-push guardrails: lint + test suite (401 passed, 2 deselected)

Notes

• clean-context review rerun: No implementation-vs-plan drift found.
• User Access Administrator remains intentionally out of the defended escalation model for this slice.