downloader: error on extraneous snapshots when resuming an incomplete sync

## Problem

When resuming a sync that did not complete, the snapshot directory may contain files that are not part of the current preverified set — leftover from a previous partial download, a branch switch, or a prune-mode change. Continuing the sync with these extraneous files present risks building on an inconsistent base and makes it harder to reason about the directory state.

## Proposed behaviour

When the node determines that an initial sync is required (i.e. sync has not completed) and scans the snapshot directory:

1. Identify any snapshot files present that are **not** described by the resolved `preverified.toml` (after filters are applied).
2. If any such files exist: **error out** with a clear message identifying the extraneous files.
3. Require the operator to pass an explicit flag (e.g. `--snap.allow-reset`) to authorise cleanup and proceed. This makes the destructive cleanup action opt-in rather than silent.

This is consistent with the recommendation in #19435 that `erigon snapshots reset` should be the canonical path to a clean state, and that the node should require explicit acknowledgement before taking cleanup actions.

## Non-goal

This check applies only when resuming an **incomplete** sync. Once sync has completed (see #19717 — sync completion marker), files may change and move in ways that are valid and expected; the check should not apply in that state.

## Related issues

- #19717 — persist preverified.toml and write sync-completion marker
- #19715 — record and validate download filters (filter changes are likely to be the cause of extraneous files)
- #19714 — preverified source selection on main node
- #19435 — AddTorrentsFromDisk race; recommends snapshot reset as canonical cleanup path
- #19669 — restart instability: extraneous files from prior partial sync contributed to confusion