Fail closed on unreadable manifests instead of losing blobs (closes #157)

Prune learned which blobs are in use by reading every snapshot's manifest, but merely logged and skipped one it could not download or decode. Blobs referenced only by that snapshot then looked unreferenced and were deleted, with a zero exit -- and snapshot create --prune runs this unattended. collectReferencedBlobs now errors, naming the remote key, so prune deletes nothing and exits non-zero.

Manifest generation likewise skipped a blob whose lookup failed or was missing, yielding a manifest short of what the snapshot needs; it now fails. Deep verify only warned when the manifest omitted a database blob; it now fails on any divergence. Docs corrected.

Model: opus-4-8

internal/snapshot/snapshot.go

@@ -809,6 +809,11 @@ func (sm *SnapshotManager) copyFile(src, dst string) error {
 	return nil
 }
 
+// errBlobMissingFromDatabase means a snapshot references a blob that is
+// absent from the blobs table, so a complete manifest cannot be built.
+var errBlobMissingFromDatabase = errors.New(
+	"blob referenced by snapshot is not in the database")
+
 // generateBlobManifest creates a compressed JSON list of all blobs in the snapshot
 func (sm *SnapshotManager) generateBlobManifest(
 	ctx context.Context, dbPath string, snapshotID string,
@@ -839,20 +844,26 @@ func (sm *SnapshotManager) generateBlobManifest(
 	totalCompressedSize := int64(0)
 
 	for _, hash := range blobHashes {
+		// Every blob the snapshot references must appear in the manifest.
+		// Prune consults only the manifest to decide what is still in use,
+		// so silently dropping a blob here would let a later prune delete
+		// it while this snapshot still needs it. A lookup failure or a
+		// missing blob row therefore fails manifest generation.
 		blob, err := repos.Blobs.GetByHash(ctx, hash)
 		if err != nil {
-			log.Warn("Failed to get blob details", "hash", hash, "error", err)
-
-			continue
+			return nil, fmt.Errorf("getting blob details for %s: %w", hash, err)
 		}
 
-		if blob != nil {
-			blobs = append(blobs, BlobInfo{
-				Hash:           hash,
-				CompressedSize: blob.CompressedSize,
-			})
-			totalCompressedSize += blob.CompressedSize
+		if blob == nil {
+			return nil, fmt.Errorf("%w: blob %s, snapshot %s",
+				errBlobMissingFromDatabase, hash, snapshotID)
 		}
+
+		blobs = append(blobs, BlobInfo{
+			Hash:           hash,
+			CompressedSize: blob.CompressedSize,
+		})
+		totalCompressedSize += blob.CompressedSize
 	}
 
 	// Create manifest. SnapshotID in the unencrypted manifest is the