Check blob sizes and the database in shallow verify (closes #169)

Shallow snapshot verify only checked that each blob object existed and then reported "All blobs verified", overstating what it did.

It now compares each blob stored size against the manifest compressed_size, using the same comparison as the deep path, and checks that the snapshot encrypted database (db.zst.age) is present. A blob of the wrong size no longer counts as verified. The final line reports only what was checked: presence and size, not contents.

The README verify description and the CLI short/long text are corrected to match. Removed the now-unused resolveAndDownloadManifest helper and errBlobsMissing sentinel.

Model: opus-4-8

internal/cli/snapshot.go

@@ -188,8 +188,11 @@ func newSnapshotVerifyCommand() *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:   "verify <snapshot-id>",
-		Short: "Verify snapshot integrity",
-		Long: "Verifies that all blobs referenced in a snapshot exist.\n\n" +
+		Short: "Check a snapshot's blobs are present with the listed size",
+		Long: "Checks that every blob the snapshot's manifest lists is present\n" +
+			"in storage with the size the manifest records, and that the\n" +
+			"snapshot's encrypted database is present. It does not read blob\n" +
+			"contents; use --deep to download and cryptographically verify them.\n\n" +
 			"The snapshot may be named by its ID or, on a host with no local\n" +
 			"index, by the remote key that 'snapshot list' prints for a\n" +
 			"remote-only snapshot (an unambiguous leading part is enough).",