When a file exists under multiple SHA1s (e.g. awbios.zip in both
Arcade/ and Sega/Dreamcast/), prefer the candidate whose MD5
matches the expected hash instead of always picking the first.
Batocera: 589 -> 661 verified (+72), RetroBat: 341 -> 343 (100%)