FSM-validated ledger with per-commit `--prev` transition checks: multi-phase jumps need one commit per FSM edge