Make snapshot list report a changed destination instead of advising prune (closes #317)

When the local index is bound to a different destination than the
configured one, snapshot list now gives the warning prune, snapshot
purge and snapshot remove refuse with: both destinations and the two
ways out (revert the configuration, or run vaultik database delete).
Below the table it replaces the local-only note and its prune advice.
With --json it goes to stderr through the logger, so stdout stays the
document, whose local rows show remote_present false.

Reading the binding moves out of EnsureStorageBinding into
storageBinding, which records nothing, so the read-only list can call
it without binding a fresh index.

Model: opus-5-5

internal/vaultik/snapshot_list.go

@@ -61,7 +61,9 @@ const tabPadding = 3
 // attempt is made to recover or fabricate the human ID.
 //
 // Snapshots in the local index with no counterpart on the destination
-// store are reported as drift below the table.
+// store are reported as drift below the table, unless the local index
+// is bound to a different destination than the configured one: that is
+// reported instead.
 //
 // If remote listing fails (unmounted volume, permission denied,
 // network), we degrade to local-only with a warning. List never fails
@@ -103,7 +105,26 @@ func (v *Vaultik) ListSnapshots(jsonOutput bool) error {
 		return snapshots[i].Timestamp.After(snapshots[j].Timestamp)
 	})
 
+	stored, configured, err := v.storageBinding()
+	if err != nil {
+		return err
+	}
+
+	// A local index bound to another destination describes that one, so
+	// its records are expected to be missing here, and prune refuses to
+	// run. The binding is reported instead of advising prune.
+	boundElsewhere := stored != "" && stored != configured
+
 	if jsonOutput {
+		// stdout holds only the document, so this goes to the logger.
+		if boundElsewhere {
+			log.Warn("Local index is bound to a different backup "+
+				"destination; to proceed, revert storage_url (or the s3.* "+
+				"endpoint, bucket and prefix) to the bound destination, "+
+				"or run 'vaultik database delete'",
+				"bound_to", stored, "configured", configured)
+		}
+
 		if remoteErr == nil {
 			v.reportJSONListingLimits(listing)
 		}
@@ -125,8 +146,13 @@ func (v *Vaultik) ListSnapshots(jsonOutput bool) error {
 		}
 	}
 
+	if boundElsewhere {
+		v.UI.Warningf("%v\n%s", errStorageBindingMismatch,
+			buildBindingMismatchMessage(stored, configured))
+	}
+
 	if remoteErr == nil {
-		v.reportListDrift(snapshots, listing)
+		v.reportListDrift(snapshots, listing, boundElsewhere)
 	}
 
 	return nil
@@ -432,7 +458,9 @@ func (v *Vaultik) snapshotInfoFromLocal(ls *database.Snapshot) SnapshotInfo {
 // reportListDrift prints the reconciliation notes the merged table
 // cannot express on its own: local records with no counterpart on the
 // destination store, plus counts of remote snapshots that were
-// unreadable or omitted.
+// unreadable or omitted. Local records are not reported when
+// boundElsewhere is set: ListSnapshots has already said why they are
+// missing.
 //
 // This is what remains of the old reportRemoteDrift, and it no longer
 // touches the destination store. Its remote-only half collapsed into
@@ -441,6 +469,7 @@ func (v *Vaultik) snapshotInfoFromLocal(ls *database.Snapshot) SnapshotInfo {
 // so `snapshot list` lists the destination exactly once per invocation.
 func (v *Vaultik) reportListDrift(
 	snapshots []SnapshotInfo, listing *remoteSnapshotListing,
+	boundElsewhere bool,
 ) {
 	var localOnly []string
 
@@ -450,7 +479,7 @@ func (v *Vaultik) reportListDrift(
 		}
 	}
 
-	if len(localOnly) > 0 {
+	if len(localOnly) > 0 && !boundElsewhere {
 		v.UI.Warningf("%d local snapshot record(s) not found in backup "+
 			"destination store:", len(localOnly))