v0.9.4 - Read It Back: `gc` Proves the New Pack by Content, and a Snapshot Checks Its Payload Objects After the Push

What's Changed in v0.9.4

The remaining items of the 0.9.3 review round, all of them about trusting what a server says. Checked
on the stub, on Linux (Debian under WSL), and against a real Seafile server (CE 13.0.28, scratch
library): the opt-in real-server tier, a payload snapshot with restore and verify, and a full gc
followed by a clone and fsck. The suite is 1079 tests.

Changed

• gc and the tail merge read the new pack back and compare SHA-256 before deleting anything. The
  listing only proves a size, and a same-length substitution (a padded partial write, a damaged
  block) passed it and led to the originals being deleted. The check costs one more download of the
  new pack under the lock already held, about 0.015 s per MiB.
• A snapshot run lists its payload objects once more after the push. A --payload-delete on
  another machine can remove an object between the pre-push check and the ref landing. The object is
  uploaded again when the source file is as it was; otherwise the run exits 1 naming it.
• A ref deletion is read back. A server that answers 200 without deleting is an error now, not ok.

Tests

• The unreadable-directory guard and the forced English git messages are covered on Windows too (the
  earlier test needed POSIX permissions and was skipped there).

Not changed, on purpose

• Bounding the server's Date offset was rejected: a client clock that is wrong is exactly what the
  offset exists to absorb.

The full list is in CHANGELOG.md.

---

Full Changelog: v0.9.3...v0.9.4