fix(ack): set the next state's transitions when ack.sh advances

[tupe12334]

Summary

• Bug: ack.sh moved current_state forward but left the old state's transitions in state.json. A second ack before the hook fired again failed with invalid next state '', so an agent had to retry the gated command after every step. On a 9-step run of the Kev PR checklist that meant about 20 extra tool calls.
• Fix: the gate stores the flow's transition map in state.json as flow_transitions. ack.sh sets transitions and next_state for the state it advances to, so acks can run back to back.
• Existing sessions: ensure_ack_sh now rewrites an ack.sh that differs from the current script, so a session started by an older steplock gets the fix on its next block.
• Cleanup: removed core/src/ack.sh, an unused copy of core/scripts/ack.sh (only scripts/ack.sh is embedded).
• schemas/session-state.schema.json documents flow_transitions. The field is optional, so older state.json files still load.

Test plan

• cargo test --locked passes (179 tests)
• cargo clippy --all-targets --locked -- -D warnings passes
• cargo fmt --check passes
• New ack_sh_advances_twice_without_a_hook_call_between runs the real ack.sh three times in a row (linear, branch, linear), then checks that the hook blocks at the last step. It fails on the old ack.sh with invalid next state 'right'.
• ensure_ack_sh_replaces_stale_script replaces the old test that asserted a stale ack.sh is kept
• Live check: this build, installed as the local steplock, replaced an existing session's old ack.sh on the next block. On this PR's own checklist run, 7 acks then ran back to back with no retried command
• CI: 13 of 13 checks passed (cargo audit runs only when Cargo.lock changes)

Kev review

Local Kev (kev-latest), one round, verified facts only:

• Merge noul: 0.835 (gate 0.8)
• Scope: keep 0.84, split 0.10, grow 0.06
• Field name: flow_transitions 0.69, all_transitions 0.18, graph 0.12
• Concerns (each asked as "X is a reason to wait"): no human review 0.50, rewriting a stale ack.sh 0.45, removing the duplicate script here 0.41. All are below the merge score, so the PR is kept as is.

🤖 Generated with Claude Code