Go on with a backup when the destination marker cannot be checked (closes #389)

A source host whose credentials allow only PUT, which the documents
say is enough to back up, failed every backup after its first: the
marker check looks the marker up with an S3 HEAD, which those
credentials are refused, and any error other than not found was
fatal.

Such an error now means the check could not be made: it is logged at
info level, so --cron stays silent, and the command goes on. Not found
still stops it. The documents now say so, and that such a host does
not notice an emptied destination, so vaultik database delete must be
run on it after the destination is emptied. The fault-injecting test
store gains a Stat hook for the test.

Model: opus-5-5

README.md

@@ -332,7 +332,9 @@ value where a list belongs or a word where a number belongs), is refused.
   command fails before the backup starts.
 * Fails before it writes anything when a `file://` destination directory
   does not exist, or when the local index holds snapshots and the
-  destination has no `vaultik-destination.txt` (see
+  destination answers that it has no `vaultik-destination.txt`. A
+  destination that refuses that look-up, as S3 does to credentials that
+  allow only PUT, is not checked (see
   [remote storage layout](#remote-storage-layout))
 
 **`snapshot list`**: Show every snapshot known to this host — the union
@@ -577,15 +579,22 @@ For an implementation-level view of the internals — the data model, the
 ```
 
 * `vaultik-destination.txt` holds one fixed line of text, with no host
-  name, path or time. A destination without it is treated as not
-  present while the local index holds snapshots stored there:
-  `snapshot create` refuses to write to it, `prune`, `snapshot purge`
-  and `remote nuke` fail, and `snapshot list` and `snapshot remove`
-  behave as for a destination that cannot be listed. This keeps an
-  unplugged volume's empty mount point from being taken for a
-  destination whose snapshots are all gone. Mount
+  name, path or time. While the local index holds snapshots stored
+  there, a destination that answers a look-up of it with not found is
+  treated as not present: `snapshot create` refuses to write to it,
+  `prune`, `snapshot purge` and `remote nuke` fail, and `snapshot list`
+  and `snapshot remove` behave as for a destination that cannot be
+  listed. This keeps an unplugged volume's empty mount point from being
+  taken for a destination whose snapshots are all gone. Mount
   the volume if it is removable; if the destination was emptied on
   purpose, run `vaultik database delete` and back up again.
+  When the store refuses the look-up, the check is skipped and the
+  command goes on. S3 refuses it on every run to credentials that
+  allow only PUT, so a host with such credentials does not notice a
+  destination emptied since its last backup, and its next backup would
+  leave out the data its local index records as already stored. After
+  the destination is emptied, run `vaultik database delete` on such a
+  host before it backs up again.
 * Blobs are two-level directory sharded using the first 4 hex chars of the blob hash
 * `db.zst.age` is a binary SQLite database (zstd compressed, age encrypted)
   containing all file metadata, chunk mappings, and relationships for the snapshot