Fail closed on unreadable manifests instead of losing blobs (closes #157)

Prune learned which blobs are in use by reading every snapshot's
manifest, but merely logged and skipped one it could not download or
decode. Blobs referenced only by that snapshot then looked unreferenced
and were deleted, with a zero exit — and `snapshot create --prune` runs
this unattended. collectReferencedBlobs now errors, naming the remote
key, so prune deletes nothing and exits non-zero.

Manifest generation likewise skipped a blob whose lookup failed or was
missing, yielding a manifest short of what the snapshot needs; it now
fails. Deep verify only warned when the manifest omitted a database
blob; it now fails on any divergence. Docs corrected.

Model: opus-4-8

internal/snapshot/manifest_gen_test.go

@@ -0,0 +1,64 @@
+//nolint:testpackage // exercises the unexported generateBlobManifest
+package snapshot
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/config"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/types"
+)
+
+// TestGenerateBlobManifest_MissingBlobFails is the regression guard for
+// issue #157: a blob the snapshot references but that is absent from the
+// blobs table used to be logged and skipped, yielding a manifest with
+// fewer blobs than the snapshot needs. Since prune trusts the manifest
+// alone, that omitted blob would be deleted at the next prune. Manifest
+// generation must fail instead.
+func TestGenerateBlobManifest_MissingBlobFails(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	ctx := context.Background()
+	dbPath := filepath.Join(t.TempDir(), "snapshot.db")
+
+	db, err := database.New(ctx, dbPath)
+	require.NoError(t, err)
+
+	repos := database.NewRepositories(db)
+
+	// A real blob row satisfies the snapshot_blobs foreign key on
+	// blob_id; the snapshot then references a different, absent hash.
+	presentBlob := &database.Blob{
+		ID:        types.NewBlobID(),
+		Hash:      types.BlobHash("present-blob-hash"),
+		CreatedTS: time.Now().Truncate(time.Second),
+	}
+	require.NoError(t, repos.Blobs.Create(ctx, nil, presentBlob))
+
+	snap := &database.Snapshot{
+		ID:       "testhost_home_2026-05-01T00:00:00Z",
+		Hostname: "testhost",
+	}
+	require.NoError(t, repos.Snapshots.Create(ctx, nil, snap))
+	require.NoError(t, repos.Snapshots.AddBlob(ctx, nil,
+		snap.ID.String(), presentBlob.ID, types.BlobHash("absent-blob-hash")))
+
+	require.NoError(t, db.Close())
+
+	sm := &SnapshotManager{
+		config: &config.Config{CompressionLevel: 3},
+		fs:     afero.NewOsFs(),
+	}
+
+	_, err = sm.generateBlobManifest(ctx, dbPath, snap.ID.String())
+	require.Error(t, err, "manifest generation must fail on a missing blob")
+	assert.Contains(t, err.Error(), "absent-blob-hash")
+}