CLI pin-first immutable snapshots

Trap: reading all inputs before validating frozen pins looks harmless because hashes are checked later, and patching verify_input_manifest() looks like a snapshot test; main() bypasses that wrapper, so invalid pins still trigger every payload read and the test exercises no swap hook. Fix: read, strictly parse, and pin-check only the manifest first; then snapshot each payload once and test by intercepting _read_regular_file().