Correct retention before enabling automatic deletion (#8)

* Correct retention before enabling automatic deletion

- Compute each retention tier's kept set independently from its own
  name range and union them, instead of carrying a single 'previous
  backup' comparison across tier boundaries - that carry-over was the
  actual cause of bug #32 (a coarser tier could evict a backup a finer
  tier, or the always-keep-latest rule, had already decided to retain)
- Group weekly retention by (ISO year, ISO week) instead of ISO week
  number alone, fixing bug #33 (same week number in different years,
  or late-December dates that belong to next year's ISO week 1, were
  treated as duplicates/collisions)
- Validate the computed retention plan (latest snapshot present, no
  phantom entries) before deleting anything
- Fix cli.py to run initiate_backup before cleanup_old_backups, and
  skip cleanup entirely if the backup raised - retention must only run
  once a new snapshot is durable and complete, and a failed backup must
  never trigger deletion of history
- Quarantine (rename) a deletion candidate before recursively removing
  it, reusing the already-hardened stale-staging-dir cleanup to finish
  the job if the process crashes mid-delete
- Remove both retention xfail markers (bugs #32, #33) now that the
  tests they guarded pass; update pre-existing tests whose expectations
  encoded the old bug (deleting the latest snapshot when it collided
  with the next-newest one in a coarser bucket)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Address Copilot review: replace asserts with runtime checks, don't swallow quarantine-delete failures

- Retention-plan validation now raises BackupFailedError instead of
  using assert, which python -O would silently strip ahead of a
  destructive operation
- _quarantine_and_delete no longer passes ignore_errors=True to
  rmtree; a removal failure is now logged with the quarantine path so
  operators can find and retry it, instead of silently leaving a
  hidden directory consuming space

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

curateipsum/cli.py

@@ -105,8 +105,11 @@ def main():
 
     exit_code = 0
     try:
-        backup.cleanup_old_backups(backups_dir=backups_dir_abs,
-                                   dry_run=args.dry_run)
+        # Retention deletes old snapshots, so it must only run once the
+        # new snapshot is durable and complete - never before, and never
+        # if the backup below raised. Running it first (or unconditionally
+        # after a failure) would let a failed backup destroy history
+        # that a successful one would have covered.
         backup.initiate_backup(
             sources=args.sources,
             backups_dir=backups_dir_abs,
@@ -114,6 +117,8 @@ def main():
             external_rsync=args.external_rsync,
             external_hardlink=args.external_hardlink,
         )
+        backup.cleanup_old_backups(backups_dir=backups_dir_abs,
+                                   dry_run=args.dry_run)
     except backup.BackupFailedError as err:
         _lg.error("Backup failed: %s", err)
         exit_code = 1