Check blob sizes and the database in shallow verify (closes #169)

Shallow snapshot verify only checked that each blob object existed and then reported "All blobs verified", overstating what it did.

It now compares each blob stored size against the manifest compressed_size, using the same comparison as the deep path, and checks that the snapshot encrypted database (db.zst.age) is present. A blob of the wrong size no longer counts as verified. The final line reports only what was checked: presence and size, not contents.

The README verify description and the CLI short/long text are corrected to match. Removed the now-unused resolveAndDownloadManifest helper and errBlobsMissing sentinel.

Model: opus-4-8

README.md

@@ -71,7 +71,7 @@ Requirements that no existing tool meets:
 ## daily use
 
 ```sh
-# verify a snapshot (shallow: checks all blobs exist)
+# verify a snapshot (shallow: checks all blobs are present with the listed size)
 vaultik snapshot verify <snapshot-id>
 
 # deep verify (downloads and cryptographically verifies every blob)
@@ -312,7 +312,9 @@ local index alone, and still exits zero.
   logger, so stdout stays a single parseable document.
 
 **`snapshot verify`**: Verify snapshot integrity.
-* Default (shallow): checks that all blobs referenced in the manifest exist in storage
+* Default (shallow): checks that every blob the manifest lists is present in
+  storage with the size the manifest records, and that the encrypted database is
+  present. It does not read blob contents.
 * `--deep`: Downloads and decrypts each blob, verifies chunk hashes against the
   encrypted metadata database
 * Accepts the same identifiers as `snapshot restore`: a snapshot ID, or a