Make prune and remote nuke fail when a delete fails (closes #290)

prune, and the prune step of snapshot create --prune, counted a blob
it could not delete and still exited 0. It now prints its summary or
--json document and then returns an error, which replaces the
"Failed to delete N blob(s)" line.

remote nuke only warned when a snapshot's metadata could not be
deleted, advised vaultik prune, which never removes metadata, and then
reported the store empty. It now stops with an error, does not report
the store empty, and says to run vaultik remote nuke --force again. A
successful nuke no longer advises prune for blobs it deletes itself.

The faultstore test double gains an OnDelete hook.

Judgement call: a snapshot nuke cannot remove from the local index
also fails the run, since its metadata is then left on the store.

Model: opus-5-5

TODO.md

@@ -22,6 +22,17 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-12: Made `prune` and `remote nuke` exit non-zero when a delete
+  fails ([issue #290](https://git.eeqj.de/sneak/vaultik/issues/290)).
+  `prune`, and the prune step of `snapshot create --prune`, counted a
+  blob it could not delete and still exited 0; it now prints its summary
+  or `--json` document and then fails. `remote nuke` warned about a
+  snapshot's metadata it could not delete, said to run `vaultik prune`,
+  which never removes metadata, and then reported the store empty. It
+  now fails without that report and says to run `vaultik remote nuke
+  --force` again, and a successful nuke no longer advises `prune` for
+  blobs it deletes itself.
+
 - 2026-10-08: Made a backup cancelled under `--skip-errors` stop at once
   ([issue #286](https://git.eeqj.de/sneak/vaultik/issues/286)). After
   Ctrl-C or SIGTERM, phase 2 treated the cancellation error from each