Hash the plaintext, not the encrypted bytes, in verify --deep (closes #131)

The last step of verify --deep hashed the encrypted bytes it downloaded once with SHA256 and compared the result to the blob name. The name is the double SHA256 of the blob plaintext, so the two could never match and deep verification failed on every healthy blob with "blob hash mismatch".

It now hashes the decompressed plaintext as chunk verification streams it and compares the double SHA256 of that to the blob name, the same derivation the writer uses. A new test backs up a real snapshot, runs deep verify on it, then flips one byte in a stored blob and expects failure.

model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)

internal/vaultik/verify.go

@@ -344,12 +344,8 @@ func (v *Vaultik) verifyBlob(blobInfo snapshot.BlobInfo, db *sql.DB) error {
 		return fmt.Errorf("failed to get decryptor: %w", err)
 	}
 
-	// Hash the encrypted blob data as it streams through to decryption
-	blobHasher := sha256.New()
-	teeReader := io.TeeReader(reader, blobHasher)
-
-	// Decrypt blob (reading through teeReader to hash encrypted data)
-	decryptedReader, err := decryptor.DecryptStream(teeReader)
+	// Decrypt blob
+	decryptedReader, err := decryptor.DecryptStream(reader)
 	if err != nil {
 		return fmt.Errorf("failed to decrypt: %w", err)
 	}
@@ -361,12 +357,19 @@ func (v *Vaultik) verifyBlob(blobInfo snapshot.BlobInfo, db *sql.DB) error {
 	}
 	defer decompressor.Close()
 
-	chunkCount, err := v.verifyBlobChunks(db, blobInfo.Hash, decompressor)
+	// A blob's hash — its remote name — is the double SHA256 of its
+	// decompressed plaintext (see blobgen.Writer.Sum256), not of the
+	// encrypted bytes. Hash the plaintext as chunk verification streams
+	// it, then compare on completion.
+	plaintextHasher := sha256.New()
+	hashedStream := io.TeeReader(decompressor, plaintextHasher)
+
+	chunkCount, err := v.verifyBlobChunks(db, blobInfo.Hash, hashedStream)
 	if err != nil {
 		return err
 	}
 
-	err = v.verifyBlobFinalIntegrity(decompressor, blobHasher, blobInfo.Hash)
+	err = v.verifyBlobFinalIntegrity(hashedStream, plaintextHasher, blobInfo.Hash)
 	if err != nil {
 		return err
 	}
@@ -470,14 +473,13 @@ func (v *Vaultik) verifyBlobChunks(
 }
 
 // verifyBlobFinalIntegrity checks that no trailing data exists in the
-// decompressed stream and that the encrypted blob hash matches the
-// expected value.
+// decompressed stream and that the blob hash matches the expected value.
 func (v *Vaultik) verifyBlobFinalIntegrity(
-	decompressor io.Reader, blobHasher hash.Hash, expectedHash string,
+	plaintext io.Reader, plaintextHasher hash.Hash, expectedHash string,
 ) error {
 	// Verify no remaining data in blob - if the chunk list is accurate,
 	// the blob should be fully consumed.
-	remaining, err := io.Copy(io.Discard, decompressor)
+	remaining, err := io.Copy(io.Discard, plaintext)
 	if err != nil {
 		return fmt.Errorf("failed to check for remaining blob data: %w", err)
 	}
@@ -486,8 +488,11 @@ func (v *Vaultik) verifyBlobFinalIntegrity(
 		return fmt.Errorf("%w: %d bytes", errTrailingBlobData, remaining)
 	}
 
-	// Verify blob hash matches the encrypted data we downloaded
-	calculatedBlobHash := hex.EncodeToString(blobHasher.Sum(nil))
+	// The blob hash is the double SHA256 of its plaintext content.
+	firstHash := plaintextHasher.Sum(nil)
+	secondHash := sha256.Sum256(firstHash)
+	calculatedBlobHash := hex.EncodeToString(secondHash[:])
+
 	if calculatedBlobHash != expectedHash {
 		return fmt.Errorf("%w: calculated %s, expected %s",
 			errBlobHashMismatch, calculatedBlobHash, expectedHash)