Delay deletions of stale files
The race condition that this avoids is as follows: a revocation
check races a fetch. The revocation first read the manifest, and
finds files `[A, B, C]`. Now the fetch obtains the new manifest,
which contains `[B, C]`. It saves the new manifest. It determines
file `A` is unused, so it deletes it. Now the revocation check
loads files from its (in memory manifest) and finds `A` to be missing.
We avoid this by having the fetch process avoid deleting files that
are referenced by any prior manifest.