Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup writes vaultik-destination.txt at the destination root.
While the local index holds snapshots, a destination without it is
not present: snapshot create refuses before writing, prune and
snapshot purge fail, snapshot list and snapshot remove warn. remote
nuke deletes it last. The file:// backend no longer creates its
destination directory and checks for it on every write, which
protects a directory on a removable volume but not a mount point.

Tests back up into directories that exist; fixtures standing for a
written destination carry the marker, and two tests check they get
past it.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, snapshot name selection moved
into snapshotNamesToCreate and the --force/--json test into
confirmRemoveSnapshot, both unchanged.

Model: opus-5-5

internal/storage/file.go

@@ -21,9 +21,13 @@ type FileStorer struct {
 // NewFileStorer creates a new filesystem storage backend.
 //
 // Construction is intentionally cheap and does not touch the filesystem.
-// The basePath is recorded; the directory is created lazily on first
-// write. Write operations (Put/PutWithProgress) call MkdirAll for the
-// per-blob parent directory, which also covers basePath on first use.
+// The backend never creates basePath: the user does, so that when
+// basePath is a directory on an unplugged volume, a write fails instead
+// of landing on the disk under the mount point. This does not hold when
+// basePath is the mount point itself, which stays behind when its volume
+// is unplugged.
+// Put and PutWithProgress fail on a missing basePath and create the
+// directories below it as needed.
 // Get and Stat report a key under a missing basePath as ErrNotFound.
 // List and ListStream fail on a missing basePath, because listing it as
 // an empty store would make `prune` drop every local snapshot record.
@@ -299,7 +303,19 @@ func (f *FileStorer) writeAtomic(
 	path := f.fullPath(key)
 	dir := filepath.Dir(path)
 
-	err := f.fs.MkdirAll(dir, storageDirPerm)
+	// Checked on every write, so a destination that disappears part-way
+	// through a backup fails it rather than being recreated by MkdirAll.
+	_, err := f.fs.Stat(f.basePath)
+	if os.IsNotExist(err) {
+		return fmt.Errorf("destination directory does not exist; "+
+			"create it, or mount the volume it is on: %w", err)
+	}
+
+	if err != nil {
+		return fmt.Errorf("checking destination directory: %w", err)
+	}
+
+	err = f.fs.MkdirAll(dir, storageDirPerm)
 	if err != nil {
 		return fmt.Errorf("creating directories: %w", err)
 	}