fix(security): bound reviewed lock transition - #8165

PR #8165 did not pass CI / Pull Request attempt 1 (failure), so no E2E run was dispatched.

Jobs that did not pass:

• reviewed-npm-audit — failed step: Audit reviewed production npm graphs.
• checks — failed step: Verify required PR checks.