fix(free): journal compare-and-set on prior state (#296)

[MrDarkRoot]

Authorization

Founder GO: #296 comment 2026-10-15T13:47:45Z (journal CAS only) + #294 superseding P0 GO. Scope is #296 only; no #295/#297, no version bump, no release.

Problem

Price_Apply_Journal::transition() updated by (plan_id, product_id) with no state predicate, so a stale/lock-free caller could demote APPLIED and the applied_at=IF(...NULL) expression cleared durable evidence.

Change (narrow)

• transition() takes required $expected prior state, validates the pair against a closed allowlist (PENDING->{PENDING,APPLYING,CONFLICT,FAILED,NEEDS_REVIEW}, APPLYING->{APPLIED}; no transition out of APPLIED, no PENDING->APPLIED skip), and adds AND state=%s to the UPDATE predicate. Zero affected rows throws JOURNAL_MISMATCH.
• 3 callers in Woo_Price_Mutator pass the state read under lock. Failure paths unchanged (throw -> rollback -> NEEDS_REVIEW, never into save()).
• applied_at expression, schema (v3), and existing semantics untouched.

Tests

• New hermetic matrix wordpress/tests/durable/journal-cas-unit.php: php wordpress/tests/durable/journal-cas-unit.php -> PASS 49/49 (happy path, stale-vs-APPLIED, legacy-shape defect control, duplicates, interleaving, invalid pairs, failure contract).
• durable/integration.php: appended real-engine stale/duplicate/skip/demotion cases (run in CI on MySQL+MariaDB).
• Local: php -l clean, bash .github/ci/pr-fast.sh -> PR_FAST PASS.
• BLOCKED locally (no Docker here): durable/run.sh, jobs/undo suites -> must go green in CI before merge.

Maintainer

Please inspect diff + CI before merge. Do not merge until journal/jobs/undo workflows pass. Closes nothing automatically; reconciles #296 acceptance criteria.