Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup now writes vaultik-destination.txt at the root of the
backup destination store. While the local index holds snapshots, a
destination without it is treated as not present: snapshot create
refuses before writing anything, prune and snapshot purge fail, and
snapshot list and snapshot remove warn, as for a destination that cannot
be listed. remote nuke deletes the marker last. The file:// backend no
longer creates its destination directory and checks for it on every
write.

Tests that backed up into a directory they never created now use an
existing one; fixtures that stand for a written destination carry the
marker.

Judgement call: the marker is rewritten on every backup.
Deviation: snapshot name selection moved out of CreateSnapshot, unchanged, to stay within the complexity limit.

Model: opus-5-5

TODO.md

@@ -22,6 +22,19 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-13: Stopped an unplugged volume's empty mount point from being
+  taken for an empty destination
+  ([issue #239](https://git.eeqj.de/sneak/vaultik/issues/239)). With
+  `storage_url` at a mount point, `prune` dropped every local snapshot
+  record, and `snapshot create` wrote the whole backup to the disk under
+  it. Every backup now writes `vaultik-destination.txt` at the root of
+  the destination. While the local index holds snapshots, a destination
+  without it is not present: `snapshot create` refuses to write, `prune`
+  and `snapshot purge` fail, and `snapshot list` and `snapshot remove`
+  warn. The `file://` backend no longer creates its destination
+  directory, so a write to a missing one fails; the README quickstart
+  creates it.
+
 - 2026-10-12: Rejected a retention duration longer than about 292 years
   ([issue #289](https://git.eeqj.de/sneak/vaultik/issues/289)). The
   number given to `--older-than` or `--keep-newer-than` was multiplied