Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup now writes vaultik-destination.txt at the root of the
backup destination store. While the local index holds snapshots, a
destination without it is not present: snapshot create refuses before
writing, prune and snapshot purge fail, and snapshot list and snapshot
remove warn, as for a destination that cannot be listed. remote nuke
deletes the marker last. The file:// backend no longer creates its
destination directory and checks for it on every write.

Tests now back up into existing directories, and fixtures standing for
a written destination carry the marker.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, snapshot name selection left CreateSnapshot and the --force/--json test moved into confirmRemoveSnapshot, both unchanged.

Model: opus-5-5

internal/storage/file.go

@@ -21,9 +21,10 @@ type FileStorer struct {
 // NewFileStorer creates a new filesystem storage backend.
 //
 // Construction is intentionally cheap and does not touch the filesystem.
-// The basePath is recorded; the directory is created lazily on first
-// write. Write operations (Put/PutWithProgress) call MkdirAll for the
-// per-blob parent directory, which also covers basePath on first use.
+// The backend never creates basePath: the user does, so that a write to
+// an unplugged volume fails instead of landing on the disk under its
+// empty mount point. Put and PutWithProgress fail on a missing basePath
+// and create the directories below it as needed.
 // Get and Stat report a key under a missing basePath as ErrNotFound.
 // List and ListStream fail on a missing basePath, because listing it as
 // an empty store would make `prune` drop every local snapshot record.
@@ -297,7 +298,19 @@ func (f *FileStorer) writeAtomic(
 	path := f.fullPath(key)
 	dir := filepath.Dir(path)
 
-	err := f.fs.MkdirAll(dir, storageDirPerm)
+	// Checked on every write, so a destination that disappears part-way
+	// through a backup fails it rather than being recreated by MkdirAll.
+	_, err := f.fs.Stat(f.basePath)
+	if os.IsNotExist(err) {
+		return fmt.Errorf("destination directory does not exist; "+
+			"create it, or mount the volume it is on: %w", err)
+	}
+
+	if err != nil {
+		return fmt.Errorf("checking destination directory: %w", err)
+	}
+
+	err = f.fs.MkdirAll(dir, storageDirPerm)
 	if err != nil {
 		return fmt.Errorf("creating directories: %w", err)
 	}