Delete metadata directories a backup left without a manifest (closes #390)

A backup that stopped between uploading db.zst.age and its manifest
left that directory under metadata/ on the destination for good:
prune deleted nothing there.

The blob step of prune, which snapshot create --prune also runs, now
deletes each directory under metadata/ that has no manifest.json.zst,
that no local snapshot record claims, and all of whose objects are
older than prune_grace_period; an object listed with no time keeps its
directory, and only names that are remote keys are deleted. The prompt
and the --force output name each such directory, the --json result
counts them (metadata_dirs_deleted, metadata_dirs_failed), and a failed
delete fails the run. Every description of the grace period now
covers these directories.

Model: opus-5-5

internal/cli/config.go

@@ -239,8 +239,10 @@ storage_url: ""
 # Default: 3
 # compression_level: 3
 
-# How old a blob that no snapshot lists must be before prune deletes it.
-# A backup uploads its blobs before the manifest that lists them, so on a
+# How old a blob that no snapshot lists must be before prune deletes it,
+# and how old every object in a directory under metadata/ with no manifest
+# must be before prune deletes that directory. A backup uploads its blobs
+# and its db.zst.age before the manifest that lists them, so on a
 # destination shared between hosts or users this must be longer than the
 # longest backup run. It does not protect a blob a backup reuses from an
 # earlier run that stopped before its manifest: that blob keeps the time of