fn update_manifest(pages_dir: &Path, all_rel: &[PathBuf]) -> Result<()>
The manifest is the ownership boundary: only previously generated pages can be pruned.