snapshotfetch: write appdb meta.json on fetch --import success

[zrbecker]

Summary

Standalone malcom snapshot import writes <appdb>/meta.json after the import succeeds (in cli/snapshotimport/run.go:268-278), carrying chain_id, height, imported_at, source_snapshot_hash_hex, and db_backend. Downstream commands — malcom verify, malcom bootstrap, malcom bootstrap heal — read this file to default --chain and --height; without it operators have to pass both flags explicitly.

The pipelined fetch --import flow never wrote that file. cli/snapshotfetch/pipeline.go drove snapshotimport.ImportParallel directly and then jumped straight to verify, skipping the appdb-meta write.

Fix

• pipelineState captures snapDir in onDownloadReady.
• New pipelineState.writeAppDBMeta(now time.Time) error reads the snapshot's meta.json (for hash_hex), builds an AppDBMeta, and calls snapshotimport.WriteAppDBMeta.
• cli/snapshotfetch/run.go invokes it between pipeline.finalize and runPostImportVerify on the success path. Failure to write the meta returns ExitDiskFailed.

Test plan

• TestPipelineWriteAppDBMeta — seeds a fake snapshot meta.json with a known hash_hex, runs the writer, and round-trips through snapshotimport.ReadAppDBMeta to confirm ChainID, Height, SourceSnapshotHashHex, DBBackend, and ImportedAt are all written correctly.
• Two error-path tests: missing snapDir, missing snapshot meta.json. Both surface a clear error rather than blowing up later in the pipeline.
• go test ./... -race -count=1 — full module green.
• go vet ./... && go build ./... — clean.

Impact

After this lands, fetch --import outputs are interchangeable with the two-step fetch + import outputs — same files, same downstream defaults. Operators running malcom verify --appdb <out> or malcom bootstrap --appdb <out> no longer have to pass --chain and --height redundantly.