fix: tolerate empty grep result in backup retention (#93)

When the keep-list covers every backup file (steady state until 14+
dailies accumulate), grep -vxFf finds no matches and exits 1. With
set -o pipefail on the remote shell, the whole service fails even
though the backup itself succeeded.

Wrap grep in a brace group with || true so an empty match becomes
a no-op delete instead of a service failure.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>