fetch refuses a manifest that lists another file's temp name (closes #151)

fetch downloads each file to a temp name beside it and first removes
whatever is there. A manifest listing both a.txt and .a.txt.tmp had
fetch delete the second while fetching the first, then exit 0 with a
tree check rejects.

The refusal of a manifest that lists the saved manifest's own name or
temp name now covers this too: a listed file, or a directory a listed
file is in, may not sit at any name fetch writes besides the listed
files themselves. Temp names come from tempPathFor, names are compared
ignoring case as before, and the refusal still happens before the
destination is created or any file requested.

Model: opus-5-5

internal/cli/fetch_test.go

@@ -1188,13 +1188,17 @@ func TestFetchRefusesListedManifestName(t *testing.T) {
 // .a.txt.tmp, the temp file fetch downloads a.txt to, at the top of the
 // tree and in a directory. Downloading a.txt would remove .a.txt.tmp, so
 // fetch must refuse the manifest before it creates the destination or
-// requests any file. A manifest that lists only one of the two is fetched
+// requests any file. README with .README.tmp checks that temp names are
-// in full.
+// compared ignoring case. A manifest that lists only one of the two is
+// fetched in full.
 func TestFetchRefusesListedTempName(t *testing.T) {
 	t.Parallel()
 
 	for _, dir := range []string{"", "sub/"} {
-		file, tmp := dir+"a.txt", dir+".a.txt.tmp"
+		for file, tmp := range map[string]string{
+			dir + "a.txt":  dir + ".a.txt.tmp",
+			dir + "README": dir + ".README.tmp",
+		} {
 			both := map[string][]byte{
 				file: []byte("a file"),
 				tmp:  []byte("a file at its temp name"),
@@ -1232,6 +1236,7 @@ func TestFetchRefusesListedTempName(t *testing.T) {
 			}
 		}
 	}
+}
 
 // builtManifest returns a manifest of files, built directly rather than
 // scanned, since a scan lists no hidden files and never a path starting