Compute the content hash only when head and tail match (closes #61)

A file of 10 MiB or more now gets only its 64 KiB head and tail in the
hash phase, so its content is read only when it can be a duplicate. A
new content phase after the update phase finds every group of records,
anywhere in the database, that share size, head and tail and include
one without a content hash. It checks every member with lstat and, when
at least two pass, reads those without a content hash through the
existing worker pool; a stale file does not count as a match. report
and trees leave out records without a content hash. The README, help
text and TODO entry describe the gate; the schema stays at version 1.

Lint suppressed: gosec on the file open in hashContentOnly, as in
hashSignature, and on one chmod in a test.

Model: opus-5-5

trees.go

@@ -127,12 +127,12 @@ func buildHierarchy(recs []scanRec) (*treeNode, []*treeNode) {
 			size: r.size, head: r.head, tail: r.tail, content: r.content,
 		}
 
-		// An unhashed record (its size was unique when last scanned)
-		// has unknown content: give it a signature no other file can
-		// share, so trees containing it never compare equal. Real
-		// heads are hex, so the NUL-prefixed form cannot collide.
-		if sig.head == "" {
-			sig.head = "unhashed\x00" + r.path
+		// A record without a content hash has unknown content (README
+		// "Database"): give it a signature no other file can share, so
+		// trees containing it never compare equal. Real hashes are
+		// hex, so the NUL-prefixed form cannot collide.
+		if sig.content == "" {
+			sig.content = "unhashed\x00" + r.path
 		}
 
 		node.files[comps[len(comps)-1]] = sig