--verify keeps a mismatched original until a matching copy replaces it (closes #199)

With --verify, an original whose hash does not match is no longer removed
before its replacement is downloaded. replaceOriginal, beside placeOriginal
in src/library/content.ts, has the content cache's new fetchOriginal write
the replacement to a temporary file beside the original, hashes it, and
renames it over the original only when it matches; a live photo's image and
video are both hashed before either is renamed. A failed or mismatching
download leaves the old bytes and album links, removes the temporary files,
and lands in failures.json. The replacement is always downloaded, never
copied from the cache. The leftover-file cleanup also takes a live photo's
replacement files, .quak-<pid>-<random>.<ext>.

Model: opus-5-5

src/download/index.ts

@@ -199,11 +199,13 @@ const isRunning = (pid: number): boolean => {
 };
 
 // Delete the temp files a killed process left in `dir`: the writer's
-// `.quak-<pid>-<random>.tmp` and the backup copy's
-// `.quak-backup-<name>-<pid>-<random>.tmp`. Only files whose process is no
-// longer running are removed, so another process writing into the same
-// directory keeps its own. A reused process ID can only keep a leftover a while
-// longer, never remove a live one.
+// `.quak-<pid>-<random>.tmp`, the backup copy's
+// `.quak-backup-<name>-<pid>-<random>.tmp`, and the image and video of a live
+// photo downloaded to replace a stored one, `.quak-<pid>-<random>.<ext>` (see
+// `replaceOriginal`). Only files whose process is no longer running are
+// removed, so another process writing into the same directory keeps its own. A
+// reused process ID can only keep a leftover a while longer, never remove a
+// live one.
 export const removeLeftoverTempFiles = (dir: string): void => {
     let names: string[];
     try {
@@ -212,7 +214,9 @@ export const removeLeftoverTempFiles = (dir: string): void => {
         return;
     }
     for (const name of names) {
-        const match = /^\.quak-(?:.*-)?(\d+)-[0-9a-z]*\.tmp$/.exec(name);
+        const match = /^\.quak-(?:.*-)?(\d+)-[0-9a-z]*\.[0-9A-Za-z]+$/.exec(
+            name,
+        );
         if (match && !isRunning(Number(match[1]))) {
             rmSync(join(dir, name), { force: true });
         }