Track chunk-index epoch for cross-machine repair invalidation

[woutervanranst]

Context:

• The disk-backed chunk-index cache change will use the latest snapshot identity as the cache epoch for normal archive, restore, and list operations.
• Loaded prefixes will be lazily revalidated per touched prefix when their validated snapshot identity is stale.
• This deliberately leaves cross-machine explicit repair invalidation out of scope.

Problem:

• Explicit full chunk-index repair on machine A can rewrite remote chunk-index shards without publishing a new snapshot.
• Machine B may still have clean SQLite rows whose loaded-prefix snapshot identity matches the latest snapshot and therefore may keep trusting stale shard rows.
• Publishing a synthetic snapshot for repair would pollute user-visible snapshot history and blur snapshot semantics.

Potential direction:

• Add a tiny remote chunk-index epoch or manifest marker that changes after successful archive flush and after successful explicit repair.
• Store the marker identity in local SQLite metadata or per-prefix loaded state.
• Validate the marker once per operation or before trusting loaded-prefix rows, then lazily refresh touched prefixes if the marker changed.
• Specify crash ordering carefully so snapshots remain the repository commit point and repair remains explicit/idempotent.

Related OpenSpec change:

• openspec/changes/disk-backed-chunk-index-cache