fetch refuses a manifest that lists another file's temp name (closes #151)

fetch downloads each file to a temp name beside it and first removes
whatever is there. A manifest listing both a.txt and .a.txt.tmp had
fetch delete the second while fetching the first, then exit 0 with a
tree check rejects.

The refusal of a manifest that lists the saved manifest's own name or
temp name now covers this too: a listed file, or a directory a listed
file is in, may not sit at any name fetch writes besides the listed
files themselves. Temp names come from tempPathFor, names are compared
ignoring case as before, and the refusal still happens before the
destination is created or any file requested.

Model: opus-5-5

README.md

@@ -268,9 +268,12 @@ are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
       cryptographic integrity of downloaded files. A file already there with the
       size and hash the manifest lists is skipped. Once every file is in place,
       the manifest is saved there as `index.mf`, so `mfer check` can verify the
-      tree later. A manifest that lists `index.mf` (in any letter case) or
-      `.index.mf.tmp` at the top of the tree is refused before any file is
-      downloaded, since saving the manifest would replace it.
+      tree later. Each file is downloaded to a temp file beside it, such as
+      `.a.txt.tmp` for `a.txt`, then moved into place. A manifest is refused
+      before any file is downloaded if it lists a file where fetch writes
+      another: at the temp file of a listed file, or at `index.mf` or
+      `.index.mf.tmp` at the top of the tree. Names are compared in any letter
+      case.
 - `mfer fetch --require-signature <fingerprint> https://example.com/stuff/`
     - as above, but first refuses a manifest not signed by the key with that
       fingerprint, as `mfer check --require-signature` does, before downloading