Fail closed on unreadable manifests instead of losing blobs (closes #157)

Prune learned which blobs are in use by reading every snapshot's manifest, but merely logged and skipped one it could not download or decode. Blobs referenced only by that snapshot then looked unreferenced and were deleted, with a zero exit -- and snapshot create --prune runs this unattended. collectReferencedBlobs now errors, naming the remote key, so prune deletes nothing and exits non-zero.

Manifest generation likewise skipped a blob whose lookup failed or was missing, yielding a manifest short of what the snapshot needs; it now fails. Deep verify only warned when the manifest omitted a database blob; it now fails on any divergence. Docs corrected.

Model: opus-4-8

internal/vaultik/prune.go

@@ -167,6 +167,12 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 
 // collectReferencedBlobs downloads all manifests and returns the set of
 // referenced blob hashes.
+//
+// Every manifest must be read successfully. A manifest that cannot be
+// downloaded or decoded means its snapshot's blobs are unknown, so
+// treating them as unreferenced would let prune delete data a snapshot
+// still needs. Rather than risk that silent loss, any failure returns an
+// error naming the remote key and prune deletes nothing.
 func (v *Vaultik) collectReferencedBlobs() (map[string]bool, error) {
 	log.Info("Listing remote snapshots")
 	// IDs returned by listUniqueSnapshotIDs are remote keys (hashed
@@ -179,27 +185,22 @@ func (v *Vaultik) collectReferencedBlobs() (map[string]bool, error) {
 	log.Info("Found manifests in remote storage", "count", len(remoteKeys))
 
 	allBlobsReferenced := make(map[string]bool)
-	manifestCount := 0
 
 	for _, remoteKey := range remoteKeys {
 		log.Debug("Processing manifest", "remote_key", remoteKey)
 
 		manifest, err := v.downloadManifestByKey(remoteKey)
 		if err != nil {
-			log.Error("Failed to download manifest", "remote_key", remoteKey, "error", err)
-
-			continue
+			return nil, fmt.Errorf("reading manifest %s: %w", remoteKey, err)
 		}
 
 		for _, blob := range manifest.Blobs {
 			allBlobsReferenced[blob.Hash] = true
 		}
-
-		manifestCount++
 	}
 
 	log.Info("Processed manifests",
-		"count", manifestCount, "unique_blobs_referenced", len(allBlobsReferenced))
+		"count", len(remoteKeys), "unique_blobs_referenced", len(allBlobsReferenced))
 
 	return allBlobsReferenced, nil
 }