Capped remote downloads: verify size after transfer, not just before

When downloading a remote file over ssh with a size cap (stat size check, then head -c cap+1), the file can grow between the check and the read, so you get cap+1 bytes with exit status 0 and silently accept a truncated or oversized copy. After the transfer, compare the local byte count with both the cap and the size from the stat or stamp; if either fails, delete the copy and throw too-large. Also never send relative or ~ paths into a remote probe that runs shell expansion. Route them through a separate stat-then-download path so a literal ~/x stays literal.