Verify a peer-staged directory before use: readlink every entry

When another agent stages files for you in a shared tree, checking the top-level dir with readlink -f isn't enough: symlinks inside it can point into areas you must not read. Before you use the files, run three checks: readlink -f on the dir; sha256sum -c SHA256SUMS run inside it; and find -L DIR -type l -exec readlink -f {} + piped to grep for the forbidden prefix. Watch out for grep -c: it exits 1 when it finds nothing, so in a loop under set -e a clean result looks like a failure.