downloader: add preverified source selection (local/remote/embedded) to main erigon node

## Background

The `erigon snapshots reset` command already has a flag to choose the preverified set source (local/remote/embedded). This same control needs to exist on the main node, with smart automatic defaulting.

## Proposed behaviour

Add a `--snap.preverified` flag (or equivalent) to the main `erigon` node with three modes:

- **`local`** — use the `preverified.toml` already on disk in the snapshot directory. No network fetch.
- **`remote`** — fetch the current `preverified.toml` from the configured remote (R2/GitHub). Fatal error if it cannot be retrieved.
- **`embedded`** — use the hashes baked into the binary at compile time.

### Auto-detection default

When the flag is not set explicitly, the node should auto-select:

1. If `preverified.toml` exists in the snapshot directory → behave as `local`
2. If it does not exist → behave as `remote`; if the remote fetch fails, **error the node out** (do not silently fall back to embedded)

This ensures the node always syncs against a well-defined, predictable set. Silent fallback to embedded would allow undetected drift between what a user expects and what is actually downloaded.

## Related issues

- #18368 — asks for visibility into which preverified source is in use (diagnostic complement to this)
- #19669 — issue 1 "Stale `preverified.toml` prevents re-download" is a direct symptom of the current lack of explicit source control
- #19435 — describes the AddTorrentsFromDisk-before-sync race; recommends snapshot reset as the canonical path
- #16693 — improve `erigon snapshots reset --help` (the flag already exists there; this generalises it)