git-verify-pack: more careful path handling