check hashes after getting

Could be useful to have gd_get and s3_get check the hashes of the files after they download them, to ensure a match between what's in the .ind file and what's in the data file. There can be a decoupling if someone else built/edited the file that's online without committing the change to the .ind file or rerunning `gd_confirm_posted`.

Start by locating gd_get and s3_get, then inspect how hashes are recorded in the .ind file and how gd_confirm_posted updates them. Done means downloads compare their file hashes with the recorded values and report a mismatch when they differ.

Written by the indexing model from the issue text.