Refuse a manifest whose inner message version is not one (closes #169)

Loading a manifest checked only the outer message's version, so an
inner message of version 0 or a later version loaded as if it were
version one, although docs/FORMAT.md requires VERSION_ONE in both.
deserializeInner now refuses any other inner version with the same
error as an unknown outer version. Two existing tests built inner
messages with no version and expected them to load; they now write
version one.

Model: opus-5-5

mfer/deserialize.go

@@ -278,6 +278,10 @@ func (m *manifest) deserializeInner() error {
 		return fmt.Errorf("deserialize: unmarshal inner: %w", err)
 	}
 
+	if m.pbInner.GetVersion() != MFFile_VERSION_ONE {
+		return errUnknownVersion
+	}
+
 	// Validate inner UUID
 	err = validateUUID(m.pbInner.GetUuid())
 	if err != nil {