[ancongui]

A run can fail at worker entry after its native final result and verification handoff have completed, while its next implementation task is still queued. The public resume route previously refused that failed state, leaving only a new-run retry route.

Allow an explicit native operator to requeue the same run only when completed final custody, passed verification, the original resume, untouched queued task, unchanged source and exact spent usage all validate. Recheck the locked native cut and current authority before admission, retain a durable resume proof, and refuse automatic/provider-changing requests, later dispatch, unknown effects and duplicate admission.

Validation:

• 39 new host cases, 115 existing authority/resume regressions; final public-entry and locked-race subset rerun after the forged-order tightening.
• Two actual local PostgreSQL 17 regressions traverse public resume through the next dispatch and QA result, with controlled model transports and verified cleanup.
• Full mypy (409 modules), Ruff and format checks pass.

Stacked on #65. Fresh full-source qualification and profile registration are required before deploying this runtime change; existing qualification is not relabeled.

This topic is consolidated into PR75. Its exact branch head is an ancestor of PR75; no implementation or history is discarded. Review and delivery continue there. Closing this duplicate does not claim its functionality is released or that the CRM journey is complete.