a Run is gated by a DispatchPreflight validation pass (tracker creds, agent binary, workspace root, etc.) that runs once before the Run begins