Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup writes vaultik-destination.txt at the destination root.
While the local index holds snapshots, a destination without it is
not present: snapshot create refuses before writing, prune and
snapshot purge fail, and snapshot list and snapshot remove act as for
a destination that cannot be listed. remote nuke deletes it last. The
file:// backend no longer creates its destination directory and checks
for it on every write; that protects a directory on a removable
volume, not a mount point.

Tests back up into directories that exist; fixtures standing for a
written destination carry the marker; two tests check they get past
it.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, two blocks moved, unchanged, into
snapshotNamesToCreate and confirmRemoveSnapshot.

Model: opus-5-5

internal/cli/entry_snapshot_purge_test.go

@@ -41,6 +41,11 @@ func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T)
 	// too, so the purge selects it rather than dropping it as stale.
 	seedStaleSnapshotRecord(t, indexPath)
 
+	// While the local index holds a snapshot, purge fails on a
+	// destination without the marker a backup writes.
+	require.NoError(t, os.WriteFile(
+		filepath.Join(dir, "store", "vaultik-destination.txt"), nil, 0o600))
+
 	manifestDir := filepath.Join(dir, "store", "metadata",
 		snapshot.RemoteSnapshotKey(stalePruneSnapshotID))
 	require.NoError(t, os.MkdirAll(manifestDir, 0o750))
@@ -59,10 +64,12 @@ func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T)
 	require.NoError(t, err)
 	require.NoError(t, db.Close())
 
-	code, _, _ := runEntry(t, flagConfig, configPath,
+	code, _, stderr := runEntry(t, flagConfig, configPath,
 		cmdSnapshot, cmdPurge, flagOlderThan, "30d", flagForce)
 
 	assert.Equal(t, 1, code)
+	assert.Contains(t, stderr, "simulated index error",
+		"the purge must fail at the local-index delete")
 	assert.FileExists(t, manifestPath,
 		"the snapshot is still in the local index, so its metadata must stay")
 }