Skip files of an unreadable blob under restore --skip-errors (closes #218)

A blob that failed to download ended `snapshot restore` even with
--skip-errors, after restoring whichever files came first. The download
error now goes through the same per-file handling as any other restore
error, once for every pending file that references the blob. With
--skip-errors those files are reported as failed, the rest are
restored, and the command still exits non-zero. Without the flag the
restore still aborts; the error now also names one affected file and
suggests --skip-errors. A cancelled restore still ends at once. The
--skip-errors help text and README now limit the packing and storage
caveat to snapshot creation.

Model: opus-5-5

internal/vaultik/restore.go

@@ -355,7 +355,7 @@ func (v *Vaultik) runRestoreLoop(
 
 		fileID, ready := plan.popReady()
 		if !ready {
-			downloaded, err := session.downloadNextBlobSet(plan)
+			downloaded, err := session.downloadNextBlobSet(plan, filesByID)
 			if err != nil {
 				return err
 			}
@@ -411,7 +411,13 @@ func (v *Vaultik) runRestoreLoop(
 // blob set and downloads its blobs; after each blob lands, the plan
 // moves any pending file whose set just emptied onto the ready queue.
 // Returns false when nothing is pending download (the caller stops).
-func (s *restoreSession) downloadNextBlobSet(plan *restorePlan) (bool, error) {
+//
+// A blob that cannot be downloaded is reported through
+// handleRestoreFileError for every pending file that references it, so
+// it aborts the restore unless --skip-errors is set.
+func (s *restoreSession) downloadNextBlobSet(
+	plan *restorePlan, filesByID map[types.FileID]*database.File,
+) (bool, error) {
 	s.sweeper.sweep()
 
 	next, ok := plan.pickNextDownload()
@@ -433,7 +439,25 @@ func (s *restoreSession) downloadNextBlobSet(plan *restorePlan) (bool, error) {
 
 		err := s.downloadBlobToCache(hash, blob.CompressedSize, blob.UncompressedSize)
 		if err != nil {
-			return false, fmt.Errorf("downloading blob %s: %w", shortHash(hash), err)
+			err = fmt.Errorf("downloading blob %s: %w", shortHash(hash), err)
+
+			// On cancel the error says nothing about the blob, so it ends
+			// the restore instead of failing the files that need it.
+			if s.ctx.Err() != nil {
+				return false, err
+			}
+
+			for _, fileID := range plan.filesReferencingBlob(hash) {
+				fileErr := s.v.handleRestoreFileError(
+					plan, s.opts, s.result, filesByID[fileID], fileID, err)
+				if fileErr != nil {
+					return false, fileErr
+				}
+			}
+
+			// next is among the failed files, so the rest of its blob set
+			// is left for any other file that still needs it.
+			return true, nil
 		}
 
 		s.result.BlobsDownloaded++