Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup now writes vaultik-destination.txt at the root of the
backup destination store. While the local index holds snapshots, a
destination without it is not present: snapshot create refuses before
writing, prune and snapshot purge fail, and snapshot list and snapshot
remove warn, as for a destination that cannot be listed. remote nuke
deletes the marker last. The file:// backend no longer creates its
destination directory and checks for it on every write.

Tests now back up into existing directories, and fixtures standing for
a written destination carry the marker.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, snapshot name selection left CreateSnapshot and the --force/--json test moved into confirmRemoveSnapshot, both unchanged.

Model: opus-5-5

ARCHITECTURE.md

@@ -311,6 +311,8 @@ Repository interfaces:
 
 ```
 CreateSnapshot(opts)
+    │
+    ├─► markDestination()   // Refuse a destination without the marker, then write it
     │
     ├─► PruneDatabase()   // Critical: avoid dedup errors
     │
@@ -367,6 +369,8 @@ CreateSnapshot(opts)
 
 ```
 bucket/
+├── vaultik-destination.txt          # Marker written by every backup
+│
 ├── blobs/
 │   └── {hash[0:2]}/
 │       └── {hash[2:4]}/
@@ -378,6 +382,15 @@ bucket/
         └── manifest.json.zst        # Blob list (for pruning/verification)
 ```
 
+While the local index holds snapshots, a destination without
+`vaultik-destination.txt` is treated as not present
+(`checkDestinationMarker` in `internal/vaultik/destination_marker.go`):
+`snapshot create` refuses to write to it, and listing it fails as for a
+destination that cannot be listed. An unplugged volume's empty mount point
+is therefore never taken for a destination whose snapshots are all gone.
+The `file://` backend never creates its destination directory, so a write
+to a missing one fails.
+
 The `{remote-key}` directory name is a one-way double SHA-256 hash of the human
 snapshot ID, so the human ID (hostname, snapshot name, timestamp) is never
 written to the store as a directory name. See