SnapshotProducer can't count removed files or rewrite a manifest under its own schema #3252

operations that remove data files need three things the producer doesn't give them: the summary has to count what was actually marked deleted, not what the caller asked for, and not underflow (#2144 tried the last part), a manifest has to be writable under the schema and spec it was written with, and manifest names have to stay unique across commit retries (#2620 discusses where that state lives). splitting this out of #2185 so it can land on its own.