Fix the review findings in --help and config.example.yml

snapshot list says why a remote-only snapshot is listed by its remote
key. snapshot verify says what access to the destination it needs. The
note on the age-keygen file is two sentences in snapshot verify and
snapshot restore. remote nuke says "backup destination store".

config.example.yml names the commands that run without a snapshot.

Only help strings and comments change.

Model: fable-5-1

internal/cli/snapshot_restore.go

@@ -42,9 +42,9 @@ directory. File owners are restored only when the command runs as root.
 
 Requires the age private key, in the VAULTIK_AGE_SECRET_KEY environment
 variable or as age_secret_key in the config file; the environment
-variable wins. The variable may hold the whole age-keygen file (comments
-and all of its identities are accepted); read it from the file rather
-than typing the key, so it does not land in your shell history:
+variable wins. The variable may hold the whole age-keygen file, with its
+comments and all of its keys. Read the key from the file rather than
+typing it, so that it does not land in your shell history:
 
   export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"