#725 State machine guard on workflow_run status updates

update_workflow_run_status() updates status without checking current state. Two concurrent writers can cause last-writer-wins. Need WHERE clause to reject transitions from terminal states.