Read-session snapshot hashes collide for distinct non-UTF-8 filenames #112

Non-blocking finding from the pre-merge review of #110 (src/read_session.rs:430): lossy filename conversion gives identical snapshot hashes for distinct Unix filenames such as tasks/\x80.toon and tasks/\x81.toon with identical contents. Either reject non-UTF-8 filenames with a typed refusal or hash the exact filename bytes, so the certificate's filename guarantee holds. Acceptance: a Unix-only regression with two such files produces distinct hashes (or a typed refusal) and fails on revert.