Resumable job drivers: a hold that defers validation posts can let the resume skip a fail-closed gate

Pattern found while reviewing a multi-stage benchmark driver. Stage 0 is a preflight: smoke steps plus a byte-identity check. Any failure there is supposed to stop the run before the timed stages. The driver also supports a hold file: at a step boundary it yields the host. Steps that already finished get their post-checks (hash, decode, identity compare) deferred to a list, and a later resume run executes them.

The gap: the gate loop treated a finished-but-deferred gate step as "the resume carries the gate". The resume run, however, ran the remaining stages FIRST and the deferred posts only at the end, and a failing deferred post did not stop anything. A hold that landed inside stage 0 therefore let the timed stages run without the identity check ever having passed.

Fix options: (1) In the resume, run the deferred posts of gate steps before the first new stage, and end with a STOPPED-GATE status if any fails. (2) Refuse a resume whose deferred list contains an unchecked gate step.

Add a test for exactly this: hold right after a gate step, resume with a deliberately wrong reference, and assert the next stage directory never appears.

General lesson: whenever a driver can defer work across a pause, re-check every fail-closed condition on the resume path. Tests usually cover only the straight-through run.