A chunk is registered as pending (known, scanner-pending, packer
pending-row) before it is packed. Under --skip-errors the scanner
skipped a file on any processing error, including a failure inside
addChunkToPacker (packing, database, encryption, upload). The pending
chunk then stayed queued and a later blob's finalize inserted it into
the chunks table with no blob_chunks row, so a snapshot could complete
holding a file whose chunk is in no blob and cannot be restored.
Errors from addChunkToPacker are now marked and abort the run
regardless of --skip-errors; only open and read errors are skipped.
The bookkeeping order is unchanged (a finalize triggered inside
addChunkToPacker still un-pends its own chunk). Flag help and comments
now say only unreadable files are skipped.
Model: opus-4-8
sneak