Fix nine review findings in the documents and help text

- snapshot verify and snapshot restore also list the destination for a
  snapshot ID that is not in the local index: README, REPOSTRUCTURE,
  ARCHITECTURE, DATAMODEL and the two commands' help.
- prune on a separate machine deletes only unused data and does not
  remove old snapshots.
- The --quiet usage string names everything the flag leaves out.
- A warning written as a log record stays on stderr.
- config set on a config that does not load refuses three things.
- No test is held back by a build tag.
- A plain docker build . adds no -dirty.
- The backup's order of work records directories.
- TODO.md says what parallel downloads would speed up and names
  restorePlan and restoreSweeper.

Model: fable-5-1

README.md

@@ -308,8 +308,11 @@ is `vaultik config set compression_level 99`. The file is then left unchanged.
 
 A config that does not load yet is checked less strictly. An example is the file
 `config init` writes, which has no `storage_url`. There the command refuses only
-two things: an unknown key, and a value of the wrong type, such as a word where
-a number belongs.
+three things:
+
+- an unknown key
+- a value of the wrong type, such as a word where a number belongs
+- a `${ENV:NAME}` value whose variable is unset or empty
 
 ### `snapshot create`
 
@@ -477,7 +480,8 @@ Without `--deep`, it checks two things:
 - The snapshot's encrypted database is present.
 
 This reads no blob contents and needs no private key. It needs permission to
-read at the destination, and to list it when you give a remote key.
+read at the destination, and to list it when you give a remote key, or a
+snapshot ID that is not in the local index.
 
 Flags:
 
@@ -583,7 +587,7 @@ It needs:
 - The age private key, as for `snapshot verify --deep`. See
   [The private key](#the-private-key).
 - Permission to read at the destination, and to list it when you give a remote
-  key.
+  key, or a snapshot ID that is not in the local index.
 - Write access to `<target-dir>`. The command creates the directory when it does
   not exist.
 - Free temporary space for the decrypted blobs. See
@@ -1066,12 +1070,14 @@ An rclone remote that can move objects also needs permission to read and delete.
 An upload there looks up the object it replaces and deletes it. It stops when
 the look-up is refused.
 
-`snapshot verify` and `snapshot restore` list only when you give a remote key.
-`snapshot remove --local-only` does not reach the destination.
-`snapshot remove --dry-run` deletes nothing.
+`snapshot verify` and `snapshot restore` list only when you give a remote key,
+or a snapshot ID that is not in the local index. `snapshot remove --local-only`
+does not reach the destination. `snapshot remove --dry-run` deletes nothing.
 
 A machine that runs `snapshot create --prune` can delete its own backups. To
 keep it to write-only credentials, run `prune` from a separate, trusted machine.
+`prune` there deletes only data that no snapshot uses. It does not remove old
+snapshots.
 
 A backup tries to look up the marker file and each blob before it writes. On S3
 it goes on when the destination refuses those look-ups.
@@ -1095,7 +1101,8 @@ not exist, commands treat the destination as not present:
     - `prune`
     - `snapshot purge`
     - `remote nuke`
-    - `snapshot verify` and `snapshot restore`, when given a remote key
+    - `snapshot verify` and `snapshot restore`, when given a remote key, or a
+      snapshot ID that is not in the local index
 - `snapshot list` shows the local index alone.
 - `snapshot remove` deletes nothing at the destination.
 
@@ -1210,8 +1217,10 @@ stderr carries the rest:
 - log records, including those from `--verbose` and `--debug`
 - the error that a failed command ends with
 
-So `vaultik snapshot list > out.txt` captures the list and any warnings. The
-banner, log records and a final error stay on your terminal.
+So `vaultik snapshot list > out.txt` captures the list and the warnings printed
+below it. The banner, log records and a final error stay on your terminal. A
+warning written as a log record, such as the one about a config file others can
+read, stays there too.
 
 Log records are colored lines when stderr is a terminal. They are JSON, one
 object per line, when stderr is redirected.
@@ -1409,8 +1418,8 @@ call them.
 Every `docker build` in these scripts uses `--no-cache`. A cached layer would
 skip the tests or the linter and still report success.
 
-The test suite has no separate integration target. Every test runs every time.
-Each test binary is stopped after 90 seconds.
+The test suite has no separate integration target. No test is held back by a
+build tag. Each test binary is stopped after 90 seconds.
 
 To change the Go version, change these together:
 
@@ -1474,6 +1483,9 @@ The version a binary reports comes from git. It is the output of
 `script/version` gives this value to the `Makefile`. `script/docker` and
 `script/cibuild` compute it themselves.
 
+A plain `docker build .` adds no `-dirty`. The `Dockerfile` runs `git describe`
+without `--dirty`.
+
 `make` outside a git checkout, and `docker build .` without `.git`, stamp `dev`.
 An image built by `script/docker` or `script/cibuild` outside a git checkout
 reports `unknown`.