Refuse a file whose size changed between freshen's scan and hash (closes #207)

freshen took a changed or new file's size from the scan and its hash
from a later read, without comparing the bytes read with that size. A
file that grew or shrank in between got an entry no content can match,
so check failed it with nothing saying why. processEntry now fails with
a size mismatch naming the file, as gen does, so freshen exits 1 and
leaves the manifest as it was.

Judgement call: the error wraps the package's existing errSizeMismatch
from fetch; its comment now covers both uses.

Model: opus-5-5

internal/cli/freshen.go

@@ -311,6 +311,16 @@ func (h *freshenHasher) processEntry(e *freshenEntry) error {
 		return err
 	}
 
+	// The scan recorded the size; a file that grew or shrank since would
+	// get an entry whose size and hash describe different contents.
+	if bytesRead != e.size {
+		return fmt.Errorf(
+			"%w for %q: %d bytes when scanned but %d bytes when read; "+
+				"the file changed while freshen ran",
+			errSizeMismatch, e.path, e.size, bytesRead,
+		)
+	}
+
 	h.hashedBytes += bytesRead
 	h.hashedFiles++