feat(peer): validate manifests before download mutation

Why:
- Remote and UI-echoed file descriptions could reach transaction and storage
  code one entry at a time, so a hostile late path could mutate earlier files.
- Per-file consensus also accepted malformed peer lists and let duplicate rows
  inflate a source's vote.

What:
- Add a complete protocol-7 manifest adapter with catalog-root confinement,
  portable path and alias rules, reserved-path protection, shape and size caps,
  symlink/reparse inspection, and zero-mutation tests.
- Keep download selection in the peer core, validate every peer manifest before
  consensus, and pass only the validated manifest into storage/orchestration.
- Canonicalize locally advertised paths, cap exact chunk receives, and preserve
  the local-only install fast path.
- Record the chosen safety limits and follow-up ownership/catalog decisions.

Test Plan:
- just clippy
- just test
- just frontend-test
- just build
- just fmt (Rust/TOML/Prettier completed; rumdl reports 39 pre-existing issues)
- git diff --cached --check

crates/lanspread-peer-cli/src/main.rs

@@ -276,10 +276,9 @@ async fn handle_command(
         } => {
             ensure_catalog_game(shared, game_id).await?;
             ensure_no_active_operation(shared, game_id).await?;
-            let files = game_files_for_download(sender, shared, game_id).await?;
+            game_files_for_download(sender, shared, game_id).await?;
             sender.send(PeerCommand::DownloadGameFilesWithOptions {
                 id: game_id.clone(),
-                file_descriptions: files,
                 install_after_download: *install_after_download,
             })?;
             Ok(json!({"queued": true, "game_id": game_id, "install": install_after_download}))