Correct the security claims in docs and comments, and record the accepted risks (closes #171)

Docs and comments only; no behaviour change. Corrects ten overclaims the
security review found: snapshot names are hashed but the hash uses no
secret, so a guessed hostname and name can be confirmed; a blob is named
by hex(SHA256(SHA256(uncompressed contents))), stated once in
docs/REPOSTRUCTURE.md and referenced elsewhere; double hashing does not
hide known content (blob packing does); age uses ChaCha20-Poly1305, not
XChaCha20; encryption is required, not optional; a snapshot is marked
complete before its metadata is uploaded; the export comment now matches
its only caller; deep verify detects corruption, not authorship; adding a
recipient does not reach existing data; restore examples target a
user-owned directory.

Adds an Accepted Risks subsection under Security Considerations with the
seven documented risks, cross-referenced from the README.

Model: opus-4-8

internal/cli/snapshot.go

@@ -192,7 +192,8 @@ func newSnapshotVerifyCommand() *cobra.Command {
 		Long: "Checks that every blob the snapshot's manifest lists is present\n" +
 			"in storage with the size the manifest records, and that the\n" +
 			"snapshot's encrypted database is present. It does not read blob\n" +
-			"contents; use --deep to download and cryptographically verify them.\n\n" +
+			"contents; use --deep to download, decrypt, and re-hash every blob\n" +
+			"to detect corruption -- integrity, not who wrote it.\n\n" +
 			"The snapshot may be named by its ID or, on a host with no local\n" +
 			"index, by the remote key that 'snapshot list' prints for a\n" +
 			"remote-only snapshot (an unambiguous leading part is enough).",