Resumed pushes now stop if `state.json` says we've saved more bytes than
we actually did.

Before this PR, lost bytes could become NULs in a corrupt file that
still passed the final size check. The old writer extended the empty
file to offset 5. The filesystem filled the gap with NULs. Later chunks
restored the expected length, so `finalize()` accepted the file.

With this PR, any uploaded file chunk that can't be cleanly appended to
the partial staged file halts processing the request. No skipping, no
recovery attempt, just full stop. PHP likely has more uploaded file data
buffered, but we don't care. Correctness is more important than
performance and in the initial Push version, we'll be very strict. In a
future iteration we may set that one broken file aside and communicate
to the source site "hey, resend that path please", but for now we'll err
on the side of simplicity.