Function wipe 

pub fn wipe(root: &Path) -> Result<()>

Wipe every trace of collection, leaving a permanent tombstone.

Order matters and is the whole of the guarantee:

1. take the blocking lock — this is not an exit path;
2. write the tombstone first, and never remove it here;
3. truncate buffer.jsonl and dryrun.jsonl — do not unlink them, and never unlink the lock file;
4. remove install_id.json and state.json.

If any step after the tombstone fails, the error is returned and the caller logs it — but the tombstone alone already makes the buffer permanently undrainable, so a failed wipe fails closed.