Check blob sizes and the database in shallow verify (closes #169)

Shallow snapshot verify only checked that each blob object existed and then reported "All blobs verified", overstating what it did.

It now compares each blob stored size against the manifest compressed_size, using the same comparison as the deep path, and checks that the snapshot encrypted database (db.zst.age) is present. A blob of the wrong size no longer counts as verified. The final line reports only what was checked: presence and size, not contents.

The README verify description and the CLI short/long text are corrected to match. Removed the now-unused resolveAndDownloadManifest helper and errBlobsMissing sentinel.

Model: opus-4-8

internal/vaultik/snapshot_identifier.go

@@ -69,20 +69,6 @@ func (v *Vaultik) resolveSnapshotRemoteKey(identifier string) (string, error) {
 	}
 }
 
-// resolveAndDownloadManifest resolves a snapshot identifier to its remote
-// key (see resolveSnapshotRemoteKey) and downloads that snapshot's
-// manifest.
-func (v *Vaultik) resolveAndDownloadManifest(
-	identifier string,
-) (*snapshot.Manifest, error) {
-	remoteKey, err := v.resolveSnapshotRemoteKey(identifier)
-	if err != nil {
-		return nil, err
-	}
-
-	return v.downloadManifestByKey(remoteKey)
-}
-
 // isRemoteKeyOrPrefix reports whether s is a full remote key or the
 // leading part of one: 1 to 64 lowercase hex characters. A human snapshot
 // ID is never all hex, so this shape test is enough to tell the two apart.