[Coder8124]

Fixes runningbugs #369 and #371.

• #369. An index used to skip an unreadable memory file without a word. Over an index that already held the memory, it also read the skipped file as a line the user deleted, so it forgot the memory and removed the file. Now:
  • the index names the file (it does this even when it then refuses over a damaged digest);
  • it keeps the memory's row;
  • it leaves that row's unflushed flag alone;
  • a later write refuses to replace a file it could not check for hand edits.
• #371. A process killed between writing a memory file or digest and recording its hash left a file the stamp did not claim, and every later write took it for a hand edit. The stamp now holds the confirmed hash and the pending one across the write. Only one pending hash is kept, so a write that keeps failing does not grow the column.

Each commit's test fails without its fix (scripts/check-bug-tests.sh).

Review findings not taken:

• A legacy line whose uid matches an unreadable file is not migrated: doing so would write over the file nobody could read. The notice names the file instead.
• An older binary reads a stamp column holding "a,b" as no stamp. That only lasts for the in-flight window, the column now holds at most two hashes, and it does not justify a schema change.
• engine/vault.go:41's print path is unchanged.

[Coder8124]

Superseded: #109 already fixes #369 and #371 (its separate pending row also bounds the stamp). The holes review found here are ported onto #109 in #111.