Put a continuous pentest to work, from draft or from paused.

One endpoint for both, as the pre-rename one was: a client that creates a pentest and starts it cannot be asked which of the two transitions it needs. A draft is published (DRAFT → DONE); a paused pentest is resumed (PAUSED → DONE). Either way the computed status becomes RUNNING, and the recon rides the staged domain event rather than this request.

Both branches re-verify the asset cap and the continuous-test entitlement and cap, so a pause is not a way around them.

CONTINUOUS only; a wrong type or an unstartable config raises (400).

Args: pentest_slug (str): Public pentest identifier. db (AsyncSession): Request-scoped database session. context (ActiveContext): Resolved caller identity and scope.

Returns: SuccessResponse: The pre-rename lifecycle envelope.

Raises: ValueError: The pentest is not CONTINUOUS. ConflictError: An asset or continuous-test cap is exceeded (409). FeatureNotEntitledError: The plan no longer meters continuous tests (402).