Commit every staged successor atomically after comparing every source
version supplied to begin. A mismatch MUST abort the whole batch.
For finalize, the store MUST also reject an existing unexpired active
hold and atomically record the staged committed successor as the source's
new active_hold. Merely incrementing the source version is insufficient:
a later request can read that new version and otherwise mint a second hold.
Source proposal contents remain immutable.
Restore the exact pre-batch state. Safe to call after any failed stage/commit.
Stage immutable successors; implementations MUST NOT expose them before commit and MUST insert them as new records (never upsert/overwrite).