bos has suggested using hooks to easily reproduce the situations that I
described.

Here's a script to reproduces the "clone+pull" corruption.  You can specify
an alternative hg command to use through the HG environment variable.

hg verify reports a different corruption, but it's still avoidable by 
rereading the manifest and changelog after locking the repo in the pull
method.