Redmine#4899: write cf_promises_validated only on the hub or if missing

see https://cfengine.com/dev/issues/4899