Delete metadata directories a backup left without a manifest (closes #390)

A backup that stopped between uploading db.zst.age and its manifest
left that directory under metadata/ on the destination for good:
prune deleted nothing there.

The blob step of prune, which snapshot create --prune also runs, now
deletes each directory under metadata/ that has no manifest.json.zst,
that no local snapshot record claims, and all of whose objects are
older than prune_grace_period; an object listed with no time keeps its
directory, and only names that are remote keys are deleted. The prompt
and the --force output name each such directory, the --json result
counts them (metadata_dirs_deleted, metadata_dirs_failed), and a failed
delete fails the run. Every description of the grace period now
covers these directories.

Model: opus-5-5

internal/config/config.go

@@ -192,10 +192,12 @@ type Config struct {
 	CompressionLevel int                       `yaml:"compression_level"`
 
 	// PruneGracePeriod is how old a blob no manifest lists must be before
-	// a prune deletes it. A backup lists its blobs in a manifest only
-	// once it has uploaded them all, so a younger one may belong to a
-	// backup still running, on this host or another sharing the
-	// destination store.
+	// a prune deletes it, and how old every object in a directory under
+	// metadata/ with no manifest must be before a prune deletes that
+	// directory. A backup writes its manifest only once it has uploaded
+	// all its blobs and its db.zst.age, so a younger blob or directory may
+	// belong to a backup still running, on this host or another sharing
+	// the destination store.
 	PruneGracePeriod time.Duration `yaml:"prune_grace_period"`
 
 	// StorageURL specifies the storage backend using a URL format.