Correct doc and help sentences that are false about the code (closes #233)

A blob is written in full to a temporary file in $TMPDIR and uploaded
once finished, not streamed to storage, and the metadata export works on
a copy of the local index there. The README, ARCHITECTURE.md and
config.example.yml now say a backup needs free space there of the larger
of blob_size_limit and about three times the size of the local index.
Also corrected: the snapshot ID format, what restore reads and how
incomplete snapshots are removed in docs/DATAMODEL.md, what source_path
holds, the index_path default, the config search order in the snapshot
create help, what snapshot remove cleans up in the prune help, how the
release installs Go, and the script/release and script/fmt-check
comments.

Model: opus-5-5

script/fmt-check

@@ -1,6 +1,9 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
+# script/fmt-check: check formatting (read-only). Fails instead of
+# writing. It checks every Go file outside .tool, which is more than
+# script/fmt formats: `go fmt ./...` skips `testdata` directories and
+# files and directories whose names start with `.` or `_`. Fix a file
+# only this reports with `gofmt -w`.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/release

@@ -21,10 +21,9 @@ goreleaser_version() {
         head -n 1
 }
 
-# Resolve the goreleaser to run, on the same rule script/lint uses for
-# golangci-lint: a binary on PATH is accepted only when it is exactly
-# the pinned version, because a differently versioned tool would
-# produce a differently built release from the same tag. Anything else
+# Resolve the goreleaser to run. A binary on PATH is accepted only when
+# it is exactly the pinned version, because a differently versioned tool
+# would produce a differently built release from the same tag. Anything else
 # comes from .tool/bin, and a missing one is a loud failure naming the
 # script that installs it rather than a silent fallback.
 resolve_goreleaser() {