fix(benchmarks): snapshot sentinel + earlier lineage assert in T0 merge driver

[Xore]

Summary

Two non-blocking follow-ups from the #3137/#3138 review (F3/F5), both in round7_t0_merge_export.sh:

• Snapshot completion sentinel. The base snapshot_download stage had no completion marker — have_base_snapshot() only checked for model.safetensors.index.json or model.safetensors, either of which a partial download can leave on disk. A re-run then skipped the download and failed later at convert. Added .snapshot_done, mirroring the existing .merge_done sentinel in the merge stage: write-on-success, check-before-skip, and rm -rf the snapshot dir on re-entry when the marker is absent so a stale partial download can't linger.
• Manifest lineage assert moved earlier. base_f16_sha != merged_f16_sha used to run in the manifest stage (stage 5), after ollama create had already registered all four tags. Moved to a new stage 3c, right after both f16 GGUFs exist and before stage 4 registers anything — a lineage collision now aborts before any tag is created instead of after. The manifest stage reuses the two shas computed there instead of re-hashing ~15GB twice.

No behavior change beyond failing earlier / more correctly on the partial-download edge case; T0_TAGS, quantize logic, and everything else untouched.

Note: the ops copy at /mnt-1/benchmarks/round7_t0_merge_export.sh on the homeserver will be re-synced from the blob after merge (orchestrator handles that).

Closes #3139

Test plan

• bash -n round7_t0_merge_export.sh
• shellcheck round7_t0_merge_export.sh clean
• Manifest heredoc parsed with ast.parse after the edit
• Full pipeline run on homeserver (gated on cold-run completion / RAM headroom, not exercised here)

[strix-security]

Strix Security Review

No security issues found.

_{Updated for 409e6bf.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[strix-security]

Reviewed the single changed file, analysis/ghidra/benchmarks/corpus/round7_t0_merge_export.sh (a privileged, operator-run benchmark orchestration script on a private homeserver). The PR adds a snapshot-completion sentinel (including a rm -rf of a config-derived, bounded subdirectory), moves a sha256 lineage assertion earlier in the pipeline, and refactors the manifest generator to reuse precomputed hashes passed as argv. All interpolated variables are quoted, operator-configured with safe defaults, or derived from local trusted files (sha256 hex digests and stat sizes); none are attacker-controlled. No injection, authorization, secret, deserialization, SSRF, path-traversal, or other security-relevant issue was found in the changed lines. The change is a correctness/robustness refactor with no security impact.

---

Reviewed by Strix
_{Configure security review settings}

[strix-security]

Reviewed the single changed file, analysis/ghidra/benchmarks/corpus/round7_t0_merge_export.sh. The changes add a .base_snapshot_done completion sentinel around the Hugging Face snapshot download and move the base-vs-merged f16 lineage assertion to a new stage 3c, reusing the computed SHA-256 digests in the manifest stage instead of re-hashing. All new shell variables are quoted, no eval or command-substitution-to-shell sinks are introduced, no secrets are added, and there is no attacker-controlled input — the script is an operator-run local benchmark pipeline with fixed model paths, revisions, and integrity hashes. Static analysis (semgrep security/secret rules) reported no findings and bash -n passed. No security issues found in the changed code.

---

Reviewed by Strix
_{Configure security review settings}

[strix-security]

Reviewed the single changed file, analysis/ghidra/benchmarks/corpus/round7_t0_merge_export.sh. The PR adds a .base_snapshot_done completion sentinel to guard against partial-download re-entry, and moves the base-vs-merged f16 SHA lineage assertion to an earlier stage (3c), reusing those two hashes in the Python manifest step instead of re-hashing ~15GB files. The added shell commands (sha256sum, date, [ ... ]) are correctly quoted against fixed internal paths, and the two SHA values are passed to the Python heredoc as separate argv elements used only as plain strings. No injection, hardcoded secrets, path traversal, SSRF, or other security-relevant patterns are introduced by the diff. No security issues found.

---

Reviewed by Strix
_{Configure security review settings}