Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup now writes vaultik-destination.txt at the root of the
backup destination store. While the local index holds snapshots, a
destination without it is not present: snapshot create refuses before
writing, prune and snapshot purge fail, and snapshot list and snapshot
remove warn, as for a destination that cannot be listed. remote nuke
deletes the marker last. The file:// backend no longer creates its
destination directory and checks for it on every write.

Tests now back up into existing directories, and fixtures standing for
a written destination carry the marker.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, snapshot name selection left CreateSnapshot and the --force/--json test moved into confirmRemoveSnapshot, both unchanged.

Model: opus-5-5

TODO.md

@@ -22,6 +22,19 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-13: Stopped an unplugged volume's empty mount point from being
+  taken for an empty destination
+  ([issue #239](https://git.eeqj.de/sneak/vaultik/issues/239)). With
+  `storage_url` at a mount point, `prune` dropped every local snapshot
+  record, and `snapshot create` wrote the whole backup to the disk under
+  it. Every backup now writes `vaultik-destination.txt` at the root of
+  the destination. While the local index holds snapshots, a destination
+  without it is not present: `snapshot create` refuses to write, `prune`
+  and `snapshot purge` fail, and `snapshot list` and `snapshot remove`
+  warn. The `file://` backend no longer creates its destination
+  directory, so a write to a missing one fails; the README quickstart
+  creates it.
+
 - 2026-10-13: Made `snapshot remove` fail for a snapshot that does not
   exist ([issue #293](https://git.eeqj.de/sneak/vaultik/issues/293)).
   The command never checked the ID: it reported the snapshot removed