Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup now writes vaultik-destination.txt at the root of the
backup destination store. While the local index holds snapshots, a
destination without it is not present: snapshot create refuses before
writing, prune and snapshot purge fail, and snapshot list and snapshot
remove warn, as for a destination that cannot be listed. remote nuke
deletes the marker last. The file:// backend no longer creates its
destination directory and checks for it on every write.

Tests that backed up into a directory they never created now use an
existing one; fixtures standing for a written destination carry the
marker.

Judgement call: the marker is rewritten on every backup.
Deviation: snapshot name selection moved out of CreateSnapshot unchanged, for the complexity limit.

Model: opus-5-5

TODO.md

@@ -22,6 +22,19 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-13: Stopped an unplugged volume's empty mount point from being
+  taken for an empty destination
+  ([issue #239](https://git.eeqj.de/sneak/vaultik/issues/239)). With
+  `storage_url` at a mount point, `prune` dropped every local snapshot
+  record, and `snapshot create` wrote the whole backup to the disk under
+  it. Every backup now writes `vaultik-destination.txt` at the root of
+  the destination. While the local index holds snapshots, a destination
+  without it is not present: `snapshot create` refuses to write, `prune`
+  and `snapshot purge` fail, and `snapshot list` and `snapshot remove`
+  warn. The `file://` backend no longer creates its destination
+  directory, so a write to a missing one fails; the README quickstart
+  creates it.
+
 - 2026-10-12: Bound the local index to the destination an `s3.*` config
   names ([issue #298](https://git.eeqj.de/sneak/vaultik/issues/298)).
   Only `storage_url` was checked, so after `s3.bucket` or `s3.prefix`