Update a claim's status with validation of allowed transitions.

Note: submitted cannot be set through this endpoint. Submission has side effects (snapshot freeze, audit log, Discord notification, submitter attribution) that only POST /claims/{id}/submit handles. Callers targeting submitted via this handler used to silently get a half-submitted claim; we now reject them up-front.