Keep Machine effects behind state owners

[jakthom]

Summary

• replace the public effectful Machine.Fire interface with pure Machine.Next
• keep flat Do execution private to Instance and route queued and Store-backed execution through state owners
• add a regression requirement proving Machine.Next never executes Do
• update examples, package documentation, safety guidance, changelog, and architecture language
• record the decision in ADR 0004 and capture production transactional Store work in todo.md
• include the current Codex and Fable quality-review notes from scratch/

Why

The former interface could execute an effect and return a destination that callers were allowed to discard. That left the external effect standing while caller-owned state remained unchanged. The new interface makes Machine selection effect-free; effect execution and state publication now remain local to a state-owning module.

Breaking change

Callers using effect-free rows should migrate from Machine.Fire to Machine.Next. Effectful transitions must execute through Instance, queued.Runtime, or persist.Store.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• go run github.com/kisielk/errcheck@v1.20.0 ./...
• go run honnef.co/go/tools/cmd/staticcheck@v0.7.0 ./...
• gofmt and git diff --check
• focused fuzz smoke runs for Instance, Store, and queued Runtime