moss: Check installed .stone hashes (and .cache assets) against active repo .stone hashes on sync operations

[ermo]

When iterating on packages, it would be nice if we could check downloaded .stones and unpacked asset hashes before assuming they are cached, to force redownload / unpack if there's a mismatch.

This would trivially enable one to incrementally update a local repo with the exact same pkgid (name+version+release, but a different .stone hash) yet still sync to it as if it was new each time.