pub fn enforce_retention(backup_dir: &Path, keep: usize) -> Result<()>
Enforce backup retention by removing the oldest backups beyond the keep count.