A batch manifest must not double-count its sources

PDFFence 1.27 detects accidentally reused private source paths in batch review manifests without publishing paths or inferring identity.