I strongly advise you to at least involve the player whose character is temporarily to be replaced. There are at least two good reasons:
- you betray the player in question by replacing his character with a replica just like that. He won't notice until the surprise and I wouldn't appreciate a revelation like .. and look, there is .. yes, you! And the character you just played since the moment your hero left the room is actually .. well, not you .. Players usually don't like losing control of their character without a warning, explanation or chance to resist.
- if the player is actually involved he can play along with your plot much better, as you can give him information about the spy's motivation etc. Being partially involved in taking plot decisions and acting against the group with a good excuse (like this one) is usually great fun for both the gamemaster and the involved player.
Furthermore, by involving the player in this scenario he will have the chance to play the spy a tiny bit different than his character - this feels more natural when the acting is revealed and also gives the other players a fair chance to detect him.
You cannot estimate how long an adventure will take.
In my experience, it is basically impossible to make any sort of precise, accurate estimate regarding how long any given adventure will take. While it may be possible to get in the ballpark (a single encounter isn't going to take 4 hours, and a huge campaign isn't going to take a single session), there will almost always be unexpected externalities that cause you to go way over or way under on your estimates.
For example, I once prepped a multi-hour encounter with a camp of bandits, only to have the PCs agree to pay off the bandits and skip the entire encounter. In another case, I've played in a game where we found a cave, said "nope," and left, and instead went to harass a random NPC for a while.
In your example, it's possible that the character introduction section could take 5 minutes ("My name is [x], I'm from [y]") or it could take the whole session. Then, the initial goblin ambush can be quite deadly, especially if you're using surprise rules--the session can end there, if your players are unlucky. As your players encounter the sentry goblins in the guard post, they could engage in a protracted combat, or bypass the encounter by sneaking through, or burn the whole thing down.
As you can see, the breadth of options that PCs have makes it very hard to estimate how long it will take for them to get through any particular section of the adventure.
All it can take for you to wildly off in your estimates is for one player to decide that they feel like doing something different at any given moment. Maybe instead of charging into battle like they have every time, the barbarian decides to be a bit more cautious or talkative, for instance.
Breakpoints are everywhere
Generally, I find it perfectly ok to have a breakpoint anywhere that's not in the middle of a combat encounter. For example, the book breaks down a number of encounters in sequence: the goblin blind, the wolves, the steep passage, and so forth. While the party's experience through the dungeon is continuous, it's really organized by different scenes. Ending the session right before or after these is a natural breakpoint, since each is a scene transition.
Also, your players might not care about "natural" breakpoints as much as you do. Speaking for myself, I'd rather have a session end when I have to go home instead of being forced to stick around for extra time just for plot reasons. I'd ask your players how much they care about natural breakpoints versus going home on time--you might be surprised at their responses.
Best Answer
The answers provided by Niel B and CaM are good (and both have my upvotes), but I want to emphasise another aspect of this, based on my own experience with running this adventure (although this exact thing didn't happen to me; the first long rest was some time after this):
Level 1 characters are weak as hell, and this first dungeon is quite difficult for level 1 characters.
I agree that their carelessness should have an impact on the goblins, but I would advise away from anything too gameplay related like extra traps or extra enemies. Instead, I would focus on the roleplay and environment.
Stealing from Niel B's answer:
The bodies being gone and there being goblins in the bushes (assuming these are from another area, not extra goblins) who address them by name are nice touches expressed through narrative to show the players that their actions have in-game consequences.
Also stealing from CaM's answer:
This, again, shows a narrative feature (the sound of drums that wasn't there before) that shows that your party's action have consequences, and although goblins will now be paying more attention, if there's still the same number of them in the same rooms, not much has changed regarding the dungeon's difficulty, but the goblin's behaviour has, which may give the party a harder time sneaking up on them or something, but otherwise doesn't make the dungeon any harder.
As for traps, I dismissed them just now, but it might be good if you add a couple of obvious traps, or something that your most perceptive PC would be able to spot with their passive perception (so the traps don't have to be super obvious, but will still be spotted by at least one of the party); this way, it won't make the dungeon any harder than it already is (you don't actually want to punish your players, simply teach them that the world reacts to them), but it shows some effort on the goblin's part to counteract their actions, just not successfully enough to actually change the difficulty of the dungeon.
I wouldn't recommend pulling punches quite as much as this ordinarily, but they're level 1! Level 1 characters are weak as hell, like I said. Saying that, level 3, for example, they won't be as weak, and if they haven't learned yet, then not pulling punches might teach them to start paying attention. But this early on, they're still learning, and they're still weak, so try to show the consequences in a narrative way, rather than a gameplay "punishment" way.