Add a check that upload.changes.byhand_files is sane

This lets us reject an upload up front rather than dying later in
process-upload.