Executable sampling ends with awaited descriptor stat and close calls, so a
caller cancellation can arrive after the sampler's last internal check. The
sampler correctly retained the completed digest and closed its descriptor, and
the caller then launched the selected program anyway.
Recheck the caller's signal at the consuming launch boundary. A completed
sample establishes file facts; it does not authorize execution for an
operation that has already been cancelled.
Refs #4512