This includes: * Verifying that the blobs' contents corresponds to their name/hash. * Verifying that blob references in manifests and audit records refer to blobs that exist and have matching hash. The action differs by object type: * Blobs with mismatching content hash are removed. * Manifests referring to nonexistent or invalid blobs are replaced with placeholders. * Audit records with manifests referring to the same are detached. This preserves the audit log in more scenarios. The check is conservative in that all "recent enough" manifests are skipped. The repair process is functionally equivalent to a concurrent GC run; we don't yet have GC, and it's not feasible to implement it as a prerequisite for this urgently needed feature, so we take an approach that may require several re-runs in case of very recent data corruption.