Refuse mask relationship results if masks change while they are being scanned #165

Problem

The main image preprocessing run protects against sources changing while they are read: it checks the source before/after reading and refuses publication when the source changed.

The mask relationship scan does not currently have the equivalent protection. scan_masks() reads mask pixels and describe_masks() writes the report afterwards, but there is no source-fingerprint check around the scan.

If segmentation is still writing a TIFF or OME-Zarr label image, the scan can therefore analyse a changing source. For multi-plane masks this can also mix planes from different file states.

Suggested simple implementation

Before scanning a FOV, record the fingerprints of the masks that will be read. After the FOV has been read, verify the same fingerprints again.

If any mask changed:

• do not accept/stage that FOV's evidence;
• report a clear error such as mask_changed_during_scan;
• do not publish a final mask_relationships.json from mixed epochs.

This should use the existing mask/source fingerprint machinery rather than introduce a second identity system.

Acceptance

• Changing a mask during its scan is detected.
• No relationship report is published from a mixed source state.
• Unchanged masks behave exactly as before.
• TIFF masks and OME-Zarr label images are both covered.
• Once resumable per-FOV scanning exists, only validated FOVs are staged/reused.

Relevant code: mask_scan.py::scan_masks, run/mask_step.py::describe_masks, existing Fingerprint / mask manifest machinery.