fix(ownership): bound snapshot download by manifest size; clean refused builds

Addresses review on #31:
- the snapshot download limit is the manifest's size_bytes (+1, since
  ureq fails once a body reaches its limit), capped at 1 GiB; a body
  larger than advertised fails during download. New CLI test; the
  >10 MiB test also caught the off-by-one.
- a refused (oversized) standalone build removes its sqlite and
  manifest from --output-dir.
- docs: downloads are buffered, not streamed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

scripts/build-latest-ownership-snapshot.sh

@@ -278,6 +278,13 @@ fi
 if (( SNAPSHOT_BYTES > MAX_SNAPSHOT_BYTES )); then
     printf 'snapshot is %s bytes (%s monthly releases), above --max-snapshot-bytes %s; lower --history\n' \
         "$SNAPSHOT_BYTES" "$(jq -r '.snapshot.release_count' "$MANIFEST_PATH")" "$MAX_SNAPSHOT_BYTES" >&2
+    # Remove the refused pair so a standalone run leaves nothing publishable.
+    refused_sqlite="$(jq -r '.snapshot.download_url // empty' "$MANIFEST_PATH")"
+    refused_sqlite="${refused_sqlite##*/}"
+    if [[ -n "$refused_sqlite" && "$refused_sqlite" != */* ]]; then
+        rm -f "$OUTPUT_DIR/$refused_sqlite"
+    fi
+    rm -f "$MANIFEST_PATH"
     exit 1
 fi