perf(m49): defer fresh stage revalidation

src/k1link/observatory/m49_portable_source.py

@@ -599,16 +599,28 @@ def _materialize_stage(
             "authority": dict(_AUTHORITY),
         }
         manifest_path = staging / M49_PORTABLE_STAGE_MANIFEST
-        manifest_path.write_bytes(canonical_json(manifest))
+        manifest_payload = canonical_json(manifest)
+        manifest_path.write_bytes(manifest_payload)
+        manifest_sha256 = hashlib.sha256(manifest_payload).hexdigest()
         final = parent / f"{M49_PORTABLE_STAGE_PREFIX}{identity_sha256}"
         if final.exists():
             existing = validate_m49_portable_source_stage(final)
-            if existing.manifest_sha256 != hashlib.sha256(manifest_path.read_bytes()).hexdigest():
+            if existing.manifest_sha256 != manifest_sha256:
                 raise M49PortableSourceError("existing portable source stage has another manifest")
             return existing
         os.replace(staging, final)
         published = True
-        return validate_m49_portable_source_stage(final)
+        # The fresh stage consists only of files produced and hashed above.
+        # Its runner still performs the complete validation immediately before
+        # execution, so validating here would duplicate all multi-gigabyte I/O
+        # without adding a trust boundary.
+        return M49PortableSourceStage(
+            root=final,
+            identity_sha256=identity_sha256,
+            manifest_sha256=manifest_sha256,
+            timeline_frame_count=len(anchors),
+            available_lidar_frame_count=available_slot,
+        )
     finally:
         if not published:
             shutil.rmtree(staging, ignore_errors=True)