Correct retention before enabling automatic deletion (#8)

* Correct retention before enabling automatic deletion

- Compute each retention tier's kept set independently from its own
  name range and union them, instead of carrying a single 'previous
  backup' comparison across tier boundaries - that carry-over was the
  actual cause of bug #32 (a coarser tier could evict a backup a finer
  tier, or the always-keep-latest rule, had already decided to retain)
- Group weekly retention by (ISO year, ISO week) instead of ISO week
  number alone, fixing bug #33 (same week number in different years,
  or late-December dates that belong to next year's ISO week 1, were
  treated as duplicates/collisions)
- Validate the computed retention plan (latest snapshot present, no
  phantom entries) before deleting anything
- Fix cli.py to run initiate_backup before cleanup_old_backups, and
  skip cleanup entirely if the backup raised - retention must only run
  once a new snapshot is durable and complete, and a failed backup must
  never trigger deletion of history
- Quarantine (rename) a deletion candidate before recursively removing
  it, reusing the already-hardened stale-staging-dir cleanup to finish
  the job if the process crashes mid-delete
- Remove both retention xfail markers (bugs #32, #33) now that the
  tests they guarded pass; update pre-existing tests whose expectations
  encoded the old bug (deleting the latest snapshot when it collided
  with the next-newest one in a coarser bucket)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Address Copilot review: replace asserts with runtime checks, don't swallow quarantine-delete failures

- Retention-plan validation now raises BackupFailedError instead of
  using assert, which python -O would silently strip ahead of a
  destructive operation
- _quarantine_and_delete no longer passes ignore_errors=True to
  rmtree; a removal failure is now logged with the quarantine path so
  operators can find and retry it, instead of silently leaving a
  hidden directory consuming space

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

IMPROVEMENTS.md

@@ -89,13 +89,13 @@ Acceptance criteria:
 
 ### Correct retention before enabling automatic deletion
 
-- [ ] Compute retained snapshots independently for each policy tier and keep
+- [x] Compute retained snapshots independently for each policy tier and keep
   the union of those sets.
-- [ ] Compare ISO year and ISO week together.
-- [ ] Generate and validate a retention plan before deleting anything.
-- [ ] Run retention only after a new snapshot is durable and complete.
-- [ ] Quarantine deletion candidates before recursive removal.
-- [ ] Convert the existing retention `xfail` cases into passing tests.
+- [x] Compare ISO year and ISO week together.
+- [x] Generate and validate a retention plan before deleting anything.
+- [x] Run retention only after a new snapshot is durable and complete.
+- [x] Quarantine deletion candidates before recursive removal.
+- [x] Convert the existing retention `xfail` cases into passing tests.
 
 Acceptance criteria: