Check blob sizes and the database in shallow verify (closes #169)

Shallow `snapshot verify` only checked that each blob object existed and
then reported "All blobs verified", overstating what it did.

It now compares each blob's stored size against the manifest's
compressed_size, using the same comparison as the deep path, and checks
that the snapshot's encrypted database (db.zst.age) is present. A blob of
the wrong size no longer counts as verified. The final line reports only
what was checked: presence and size, not contents.

The README verify description and the CLI short/long text are corrected
to match. Removed the now-unused resolveAndDownloadManifest helper and
errBlobsMissing sentinel.

Model: opus-4-8

README.md

@@ -71,7 +71,7 @@ Requirements that no existing tool meets:
 ## daily use
 
 ```sh
-# verify a snapshot (shallow: checks all blobs exist)
+# verify a snapshot (shallow: checks all blobs are present with the listed size)
 vaultik snapshot verify <snapshot-id>
 
 # deep verify (downloads and cryptographically verifies every blob)
@@ -312,7 +312,9 @@ local index alone, and still exits zero.
   logger, so stdout stays a single parseable document.
 
 **`snapshot verify`**: Verify snapshot integrity.
-* Default (shallow): checks that all blobs referenced in the manifest exist in storage
+* Default (shallow): checks that every blob the manifest lists is present in
+  storage with the size the manifest records, and that the encrypted database is
+  present. It does not read blob contents.
 * `--deep`: Downloads and decrypts each blob, verifies chunk hashes against the
   encrypted metadata database
 * Accepts the same identifiers as `snapshot restore`: a snapshot ID, or a