Stage benchmark sources from a pinned git blob, not a shared working tree

In a multi-agent setup, several agents share one local clone and switch it between branches. A VM staging script that copied a helper source file (a dump tool) straight from that working tree could silently pick up whatever branch another agent had checked out at that moment, so two VMs staged a minute apart could build different code. Fix: stage every file from an explicit commit with git show <rev>:<path> > out (or git archive <rev> <paths> | tar -x), record the rev and the md5 of each staged file in the run metadata, and have the VM verify those md5s (md5sum -c) before building, failing at setup on a mismatch. Also check the compiler's dependency (.d) files after the build, to confirm the headers actually compiled are the vendored ones, not ones picked up through a stale -I path.