Fix the review findings in --help and config.example.yml

snapshot list says why a remote-only snapshot is listed by its remote
key. snapshot verify says what access to the destination it needs. The
note on the age-keygen file is two sentences in snapshot verify and
snapshot restore. remote nuke says "backup destination store".

config.example.yml names the commands that run without a snapshot.

Only help strings and comments change.

Model: fable-5-1

config.example.yml

@@ -24,7 +24,8 @@ age_recipients:
 
 # Named snapshots - each snapshot can contain multiple paths
 # Each snapshot gets its own ID and can have snapshot-specific excludes
-# Required: every command needs at least one snapshot with at least one path
+# Required: at least one snapshot with at least one path. Only the config
+# commands, version and completion run without one
 snapshots:
   testing:
     paths:

internal/cli/remote.go

@@ -41,9 +41,9 @@ func newRemoteNukeCommand() *cobra.Command {
 		Use:   "nuke",
 		Short: "Delete ALL snapshot metadata and blobs from the backup destination store",
 		Long: `Removes every snapshot's metadata, every blob and the destination
-marker from remote storage, and each removed snapshot from the local
-index. After this command completes successfully the bucket prefix is
-empty and the next backup starts from scratch.
+marker from the backup destination store, and each removed snapshot from
+the local index. After this command completes successfully the bucket
+prefix is empty and the next backup starts from scratch.
 
 This is destructive and irreversible. Requires --force, and permission
 to list and delete objects on the destination store.`,

internal/cli/snapshot.go

@@ -168,10 +168,10 @@ func newSnapshotListCommand() *cobra.Command {
 store, with their ID, timestamp, and sizes.
 
 Needs permission to list and read the destination store. It does not need
-the age private key. A snapshot that is only on the destination store is
-listed by its remote key, because its ID cannot be read without that key.
-If the destination store cannot be listed, the command warns and lists the
-local index alone.`,
+the age private key. A snapshot found only on the destination store is
+listed by its remote key, because its ID is stored only in the local index
+and in the snapshot's encrypted database. If the destination store cannot
+be listed, the command warns and lists the local index alone.`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return runVaultikApp(cmd, readOnly, false,
@@ -250,14 +250,17 @@ in storage with the size the manifest records, and that the
 snapshot's encrypted database is present. It does not read blob
 contents and does not need the age private key.
 
+Needs permission to read the backup destination store, and to list it
+when a remote key is given.
+
 Use --deep to download, decrypt, and re-hash every blob to detect
 corruption -- integrity, not who wrote it.
 
 --deep requires the age private key, in the VAULTIK_AGE_SECRET_KEY
 environment variable or as age_secret_key in the config file; the
 environment variable wins. The variable may hold the whole age-keygen
-file (comments and all of its identities are accepted); read it from
-the file rather than typing the key, so it does not land in your shell
+file, with its comments and all of its keys. Read the key from the
+file rather than typing it, so that it does not land in your shell
 history:
 
   export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"

internal/cli/snapshot_restore.go

@@ -42,9 +42,9 @@ directory. File owners are restored only when the command runs as root.
 
 Requires the age private key, in the VAULTIK_AGE_SECRET_KEY environment
 variable or as age_secret_key in the config file; the environment
-variable wins. The variable may hold the whole age-keygen file (comments
-and all of its identities are accepted); read it from the file rather
-than typing the key, so it does not land in your shell history:
+variable wins. The variable may hold the whole age-keygen file, with its
+comments and all of its keys. Read the key from the file rather than
+typing it, so that it does not land in your shell history:
 
   export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"