Recheck bounded prerequisites under lock

internal/app/runner.go

@@ -139,6 +139,13 @@ func executeStages(ctx context.Context, cfg *config.Config, stages []stage.Stage
 			return nil, fmt.Errorf("create manifest: %w", err)
 		}
 	}
+	// The preflight prerequisite inspection avoids creating run state for an
+	// already-invalid request. Recheck the manifest protected by the session
+	// lock because another invocation may have changed prerequisite state while
+	// this invocation waited to acquire the lock.
+	if err := validateBoundedPrerequisites(opts.Plan, m); err != nil {
+		return nil, fmt.Errorf("validate bounded run prerequisites under session lock: %w", err)
+	}
 	identity.applyToSessionManifest(m)
 	if err := env.ManifestStore.Save(ctx, manifestPath, m); err != nil {
 		return nil, fmt.Errorf("save manifest identity %q: %w", manifestPath, err)