Refuse a file whose size changed between freshen's scan and hash (closes #207)

freshen took a changed or new file's size from the scan and its hash
from a later read, without comparing the bytes read with that size. A
file that grew or shrank in between got an entry no content can match,
so check failed it with nothing saying why. processEntry now fails with
a size mismatch naming the file, as gen does, so freshen exits 1 and
leaves the manifest as it was.

Judgement call: the error wraps the package's existing errSizeMismatch
from fetch; its comment now covers both uses.

Model: opus-5-5

internal/cli/fetch.go

@@ -86,7 +86,8 @@ var (
 	// symlink that already exists in the target directory.
 	errSymlinkInPath = errors.New("symlink in path not allowed")
 	// errSizeMismatch indicates a downloaded file with an unexpected
-	// size.
+	// size, or a file freshen read at a size other than the one its scan
+	// recorded.
 	errSizeMismatch = errors.New("size mismatch")
 	// errHashMismatch indicates a downloaded file whose hash matches no
 	// manifest hash.