Backup retention has never run: the glob is inside quotes

```bash
rm "${MONTHLY_BACKUP_DIR}/*"
```

The glob is **inside double quotes**, so it never expands. `rm` tries to delete a literal file named `*`, fails, and the script continues — there is no `set -e`.

So monthly pruning has never worked. `architecture/backups.html` independently corroborates this ("Old backups are retained (no automatic rotation observed)", dated tarballs sitting in the bucket).

The daily job tars the entire 95 GB `website/` tree, so this is plausibly **35-50 GB/day** of never-pruned objects accumulating in S3 since the bug was introduced.

**Fix:** `rm -f "${MONTHLY_BACKUP_DIR}"/*` — move the glob outside the quotes. Then add an S3 lifecycle policy, which survives this script breaking again.

This is the single highest-value line change in the audit.

---

**Evidence**

```
chakrabackup-script/backup_script/zip.sh:27
```

- Verified against: `origin/master 44ca47e (2026-07-25)`
- Verdict: **CONFIRMED**

Start with chakrabackup-script/backup_script/zip.sh at line 27 and compare it with the backup behavior described in architecture/backups.html. Verify the glob is expanded for monthly pruning, then inspect the repository's S3 backup configuration for where a lifecycle policy belongs. Done means old backups are pruned and an S3 lifecycle policy provides independent retention.

Written by the indexing model from the issue text.