Function validate_transition 

pub fn validate_transition(
    from: PendingState,
    op: PendingOp,
) -> Result<TransitionResult>

Apply the state-machine matrix from specs/pending-system.md §4.

from \ op	Gate	Ungate	MarkDone
Open	→ Gated	error	→ Done
Gated	no-op	→ Open	→ Done
Done	error	error	no-op

Rationale (spec §4):

• gate from Done is an error: a fully-complete item cannot be re-gated; the intended workflow is to add a new pending item describing the follow-up gate.
• ungate from Open or Done is an error: ungate is the inverse of gate, not a generic “reset” — it requires an explicit [/] source.
• Gate on Gated and MarkDone on Done are idempotent no-ops, not errors, so the granular CLI flags can be re-run safely (skill retries, watch loops).