Fix the review findings in --help and config.example.yml

snapshot list says why a remote-only snapshot is listed by its remote
key. snapshot verify says what access to the destination it needs. The
note on the age-keygen file is two sentences in snapshot verify and
snapshot restore. remote nuke says "backup destination store".

config.example.yml names the commands that run without a snapshot.

Only help strings and comments change.

Model: fable-5-1

internal/cli/snapshot.go

@@ -168,10 +168,10 @@ func newSnapshotListCommand() *cobra.Command {
 store, with their ID, timestamp, and sizes.
 
 Needs permission to list and read the destination store. It does not need
-the age private key. A snapshot that is only on the destination store is
-listed by its remote key, because its ID cannot be read without that key.
-If the destination store cannot be listed, the command warns and lists the
-local index alone.`,
+the age private key. A snapshot found only on the destination store is
+listed by its remote key, because its ID is stored only in the local index
+and in the snapshot's encrypted database. If the destination store cannot
+be listed, the command warns and lists the local index alone.`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return runVaultikApp(cmd, readOnly, false,
@@ -250,14 +250,17 @@ in storage with the size the manifest records, and that the
 snapshot's encrypted database is present. It does not read blob
 contents and does not need the age private key.
 
+Needs permission to read the backup destination store, and to list it
+when a remote key is given.
+
 Use --deep to download, decrypt, and re-hash every blob to detect
 corruption -- integrity, not who wrote it.
 
 --deep requires the age private key, in the VAULTIK_AGE_SECRET_KEY
 environment variable or as age_secret_key in the config file; the
 environment variable wins. The variable may hold the whole age-keygen
-file (comments and all of its identities are accepted); read it from
-the file rather than typing the key, so it does not land in your shell
+file, with its comments and all of its keys. Read the key from the
+file rather than typing it, so that it does not land in your shell
 history:
 
   export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"