Prompt 02 — A Máquina de Estados

Read SPEC.md — use the schema defined there as source of truth.

You are building Prompt 02: the state persistence layer.
Do NOT modify any hook logic yet.

**Deliver in this prompt:**

1. `state/review.yaml` — initial template (empty review):
   pr_number: null
   worktree_path: null
   status: null            # SETUP|REVIEWING|SUMMARIZING|DONE
   round: 0
   max_rounds: 3
   persona: null           # Author|Reviewer|Security
   findings: []
   started_at: null
   version: 0              # CAS version — increment on every write

2. `state/state-helpers.sh` — source this in hooks and scripts:

   a) `read_state_field <field>` — reads a field from review.yaml using
      `grep "^field:" state/review.yaml | awk '{print $2}'`.
      Returns empty string if field missing or file absent.

   b) `write_state_atomic <yaml_content>` — writes content to
      state/review.yaml.tmp then renames to state/review.yaml.
      Creates state/ dir if absent.

   c) `cas_state <expected_version> <new_yaml_content>` — reads current
      version field. If it matches expected_version, calls
      write_state_atomic. If it doesn't match: prints CAS conflict to
      stderr and returns exit 1. Caller must handle.

   d) `acquire_lock` — runs `flock -n state/review.lock -c 'echo locked'`
      to test non-blocking. If another process holds the lock: prints
      error to stderr, returns exit 1.

   e) `release_lock` — removes state/review.lock. Idempotent.

3. Unit tests at `tests/test-state-helpers.sh`:
   - Write state, read it back — fields must match
   - CAS success: correct version → write succeeds
   - CAS conflict: wrong version → write fails, exit 1
   - Lock test: acquire → second acquire fails → release → acquire succeeds

**Constraints:**
- state-helpers.sh must be sourced, not executed directly
- write_state_atomic must use tmp + rename (never write directly)
- cas_state must never block — if version mismatch, fail immediately
- All helpers fail-open: errors log to stderr, never crash the caller

**Verification:**
- `bash tests/test-state-helpers.sh` runs all 4 tests and reports PASS/FAIL
- `source state/state-helpers.sh; write_state_atomic "pr_number: 42
version: 0"; read_state_field pr_number` prints "42"
- CAS test: set version to 0, call cas_state 99 ... — must fail

Tell me the test results (all 4 should PASS).