Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup writes vaultik-destination.txt at the destination root.
While the local index holds snapshots, a destination without it is
not present: snapshot create refuses before writing, prune and
snapshot purge fail, snapshot list and snapshot remove warn. remote
nuke deletes it last. The file:// backend no longer creates its
destination directory and checks for it on every write, which
protects a directory on a removable volume but not a mount point.

Tests back up into directories that exist; fixtures standing for a
written destination carry the marker, and two tests check they get
past it.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, snapshot name selection moved
into snapshotNamesToCreate and the --force/--json test into
confirmRemoveSnapshot, both unchanged.

Model: opus-5-5

internal/vaultik/restore_interrupt_test.go

@@ -65,7 +65,7 @@ func TestRestoreCleansTempDirOnInterrupt(t *testing.T) {
 	root := t.TempDir()
 
 	dataDir := filepath.Join(root, "source")
-	storeDir := filepath.Join(root, "remote")
+	storeDir := t.TempDir()
 	restoreDir := filepath.Join(root, "restored")
 	dbPath := filepath.Join(root, "index.sqlite")