Check blob sizes and the database in shallow verify (closes #169)

Shallow snapshot verify only checked that each blob object existed and then reported "All blobs verified", overstating what it did.

It now compares each blob stored size against the manifest compressed_size, using the same comparison as the deep path, and checks that the snapshot encrypted database (db.zst.age) is present. A blob of the wrong size no longer counts as verified. The final line reports only what was checked: presence and size, not contents.

The README verify description and the CLI short/long text are corrected to match. Removed the now-unused resolveAndDownloadManifest helper and errBlobsMissing sentinel.

Model: opus-4-8

internal/vaultik/verify.go

@@ -47,15 +47,20 @@ type VerifyOptions struct {
 //
 //nolint:tagliatelle // snake_case is the established JSON output format
 type VerifyResult struct {
-	SnapshotID   string `json:"snapshot_id"`
-	Status       string `json:"status"` // "ok" or "failed"
-	Mode         string `json:"mode"`   // "shallow" or "deep"
-	BlobCount    int    `json:"blob_count"`
-	TotalSize    int64  `json:"total_size"`
-	Verified     int    `json:"verified"`
-	Missing      int    `json:"missing"`
-	MissingSize  int64  `json:"missing_size,omitempty"`
-	ErrorMessage string `json:"error,omitempty"`
+	SnapshotID  string `json:"snapshot_id"`
+	Status      string `json:"status"` // "ok" or "failed"
+	Mode        string `json:"mode"`   // "shallow" or "deep"
+	BlobCount   int    `json:"blob_count"`
+	TotalSize   int64  `json:"total_size"`
+	Verified    int    `json:"verified"`
+	Missing     int    `json:"missing"`
+	MissingSize int64  `json:"missing_size,omitempty"`
+	Mismatched  int    `json:"mismatched,omitempty"`
+	// DatabaseMissing is set by shallow verify when the snapshot's
+	// encrypted database (metadata/<key>/db.zst.age) is absent, which
+	// makes the snapshot unrestorable regardless of the blobs.
+	DatabaseMissing bool   `json:"database_missing,omitempty"`
+	ErrorMessage    string `json:"error,omitempty"`
 }
 
 // deepVerifyFailure records a failure in the result and returns it appropriately