fix: renew explicit continuation authorization for bounded retries (#14987)

Preserve exact user-authorized continuation receipts across bounded retries and retain the task claim through owned retry admission. Stop, reassignment, superseding input, and active cleanup continue to block unsafe continuation.

Validation: exact-head Greptile 5/5, passing CI, no unresolved review threads, and a clean merge. Detailed verification and limitations are recorded in the pull request.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/services/execution-continuation.ts

@@ -397,6 +397,15 @@ export async function buildExecutionContinuation(input: {
               priorRuns.some(run => run.id === wake.runId && run.retryOfRunId === failedRunId))
           : rows.some(comment => comment.id === value.commentId &&
               comment.authorType === "user" &&
+              (!("commentUpdatedAt" in value || "commentBodyHash" in value || value.automaticRetry) || (
+                value.commentUpdatedAt === comment.updatedAt.toISOString() &&
+                value.commentBodyHash === createHash("sha256").update(comment.body).digest("hex")
+              )) &&
+              (!value.automaticRetry || (
+                object(value.automaticRetry).sourceRunId === explicitUserSource &&
+                comment.body.trim().length > 0 && issue.executionRunId === input.runId &&
+                priorRuns.some(run => run.id === value.runId && run.retryOfRunId === explicitUserSource)
+              )) &&
               (value.queuedCommentInterruptId
                 ? interruptQueues.some(queue => queue.id === value.queuedCommentInterruptId &&
                     queue.runId === value.runId &&