Integrate the two orphaned fixes for #5 and #6

[elysosss]

Both commits were pushed to this repository on 2026-08-03 and then left on no branch at all. git branch --contains finds nothing; the API reports them as diverged from fork/main. They were reachable only by SHA, from a comment on the issue that requested them — which is why agent-company-kit#5 and #6 are still open while the work reads as done.

Cherry-picked here onto the upstream sync, authorship preserved.

What they do

77c44a0d — serialize concurrent escalations. The plugin's read-modify-write on the escalation transition could interleave, so two reviewer-return events could both see an un-escalated task and both block it, comment, and emit. A per-company\0issue promise chain puts them in order. Same in-process shape as the mirror's lock — it closes the concurrent half, not the crash half, which is the correct scope for this bug.

66b30848 — require executor evidence before the policy handoff. commentRequired was documented as a runtime invariant and was, in fact, dead: hardcoded true at parse and read by exactly one line that copied it into another object. An agent could request done from active work and be routed into review with no comment. Now a done request from an agent under an execution policy fails with 422 unless it carries a non-empty comment.

Verified on this tree, after the sync

Check	Result
paperclip-plugin-escalation typecheck	clean
paperclip-plugin-escalation tests	12 passed, including the concurrent-return case
src/__tests__/issue-execution-policy.test.ts	71 passed
@paperclipai/server typecheck	clean

Both cherry-picks merged without conflict despite 106 commits of drift.

Base

Stacked on sync/upstream-2026-08-10 (PR #1), because these were written against a pre-sync tree and the point of re-running them here is to prove they still hold after it. Merge #1 first.

[elysosss]

Reopening to re-fire the PR-target workflow now that the default branch is fork/main.