Workflow: a transition service callable outside the change-status endpoint, with a stated actor

A lifecycle transition can only happen through the change-status endpoint. `barakoCMS/Features/Content/ChangeStatus/Endpoint.cs:178` (`HandleTransitionAsync`) checks the transition permission, self-transition rule and lifecycle enforcement at `:227-270`, and `:271` is the only place `ContentTransitioned` is constructed. `barakoCMS/Features/Workflows/Actions/UpdateFieldAction.cs:222` documents writing straight through the session, bypassing `IContentWriter`, for the no-stream case.

### Why it matters

A payment webhook marking a booking Paid (#838), a one-click approval link in an email (#840), a transition step in a nightly workflow (#835) and a per-state uniqueness rule (#830) all need to move an entry through its lifecycle with the same rules. Without a shared service each one copies the checks or skips them, and a transition made by a webhook looks different in the audit trail from one made by a person.

### The general concept

An `IContentTransitioner` in `Core/Interfaces` beside `IContentWriter`. It takes the entry, the transition name and an explicit actor (a user, a service principal or a named system actor), applies the permission, self-transition and lifecycle rules, and appends `ContentTransitioned` through the writer. The endpoint becomes one caller of it.

### Where it lives

Core: content lifecycle, exposed in `Core/Interfaces` for modules.

### Compatibility

Adds a public interface, which is a deliberate addition to the package surface. The endpoint's routes, JSON and status codes stay the same. No stored data changes.

### Done when

- The change-status endpoint calls the service, and its existing tests pass unchanged.
- A transition made through the service by a system actor is refused when the lifecycle does not allow it, and appears in audit with that actor.
- A module can resolve the interface and transition an entry in a test.

Found in the architecture sweep of 15 September 2026.

Start at barakoCMS/Features/Content/ChangeStatus/Endpoint.cs around HandleTransitionAsync and the permission, self-transition, lifecycle, and ContentTransitioned lines. Read Core/Interfaces beside IContentWriter and the bypass described in UpdateFieldAction.cs:222. Done means the endpoint delegates without changing its behavior, system actors are checked and recorded in audit, and a module can resolve and use the interface in a test.

Written by the indexing model from the issue text.