commit-graph: verify corrupt OID fanout and lookup