Check blob sizes and the database in shallow verify (closes #169)

Shallow `snapshot verify` only checked that each blob object existed and
then reported "All blobs verified", overstating what it did.

It now compares each blob's stored size against the manifest's
compressed_size, using the same comparison as the deep path, and checks
that the snapshot's encrypted database (db.zst.age) is present. A blob of
the wrong size no longer counts as verified. The final line reports only
what was checked: presence and size, not contents.

The README verify description and the CLI short/long text are corrected
to match. Removed the now-unused resolveAndDownloadManifest helper and
errBlobsMissing sentinel.

Model: opus-4-8

internal/cli/snapshot.go

@@ -188,8 +188,11 @@ func newSnapshotVerifyCommand() *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:   "verify <snapshot-id>",
-		Short: "Verify snapshot integrity",
-		Long: "Verifies that all blobs referenced in a snapshot exist.\n\n" +
+		Short: "Check a snapshot's blobs are present with the listed size",
+		Long: "Checks that every blob the snapshot's manifest lists is present\n" +
+			"in storage with the size the manifest records, and that the\n" +
+			"snapshot's encrypted database is present. It does not read blob\n" +
+			"contents; use --deep to download and cryptographically verify them.\n\n" +
 			"The snapshot may be named by its ID or, on a host with no local\n" +
 			"index, by the remote key that 'snapshot list' prints for a\n" +
 			"remote-only snapshot (an unambiguous leading part is enough).",