Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup writes vaultik-destination.txt at the destination root.
While the local index holds snapshots, a destination without it is
not present: snapshot create refuses before writing, prune and
snapshot purge fail, and snapshot list and snapshot remove act as for
a destination that cannot be listed. snapshot create checks before it
drops incomplete snapshots, snapshot remove before it looks on the
destination. remote nuke deletes the marker last. The file:// backend
never creates its destination directory; that protects a directory on
a removable volume, not a mount point.

Tests back up into directories that exist; fixtures for a written
destination carry the marker.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, two blocks moved, unchanged, into
snapshotNamesToCreate and confirmRemoveSnapshot.

Model: opus-5-5

internal/vaultik/remove_quiet_test.go

@@ -96,6 +96,10 @@ func TestRemoveSnapshot_QuietSuppressesReport(t *testing.T) {
 		store := newTestStorer()
 		addManifest(t, store, "snapshot-001", nil)
 
+		// A backup wrote to this destination, so it carries the marker.
+		require.NoError(t, store.Put(context.Background(), markerFile,
+			bytes.NewReader(nil)))
+
 		tv := vaultik.NewForTesting(store)
 		tv.Repositories = newLocalIndex(t, "snapshot-001")
 		tv.UI.SetQuiet(true)