Entity lifecycle transition guard. The middleware runs AFTER the handler — handlers don't need to know the rules. If the handler mutates state to an invalid transition, the middleware rolls back the mutation before returning xerr.Conflict.