Simplify Cursor with direct pointer manipulation

Replace the 7-variant Phase state machine with a simpler 3-state enum
and raw pointer traversal. The new Cursor operates on the linked list
in-place instead of detaching visited nodes into a "past" accumulator
and reattaching on Drop.

Also fixes a minor bug in previous impl and adds a regression test.

Author: roberto-bayardo