Add cart lock state.

It was missing from the state-machine.yml