Update the rewritten documents for the fixes merged into next

The documents, the example config and the help text are rebased onto the
fourteen fixes on next. The sentences those fixes made false now match the
code: an unknown config key, a relative index_path and a value that is not a
size are refused when the config loads; a backup saves the destination in the
local index only after it writes the marker file, and no other command saves
it; a backup skips the local index, its side files and the lock file; a binary
from go install reports its tag and counts as a release; a declined deletion
prompt exits 1 with "deletion not confirmed"; the S3 keys are set before an
s3:// storage_url. No document quoted the old messages for an unknown snapshot
ID, a wrong private key or an unreadable blob.

Model: fable-5-1

docs/DATAMODEL.md

@@ -268,9 +268,9 @@ Settings that belong to this copy of the index.
 - `key`: the name of the setting. Primary key.
 - `value`: its value.
 
-The only key is `storage_url`. It holds the destination that the index was first
-used with. These commands refuse to run when the config names a different
-destination:
+The only key is `storage_url`. A backup sets it once it has written the marker
+file at the destination. No other command sets it. These commands refuse to run
+when the config names a different destination:
 
 - `snapshot create`
 - `snapshot purge`
@@ -291,7 +291,8 @@ The migrations that have run.
 
 A backup works on the tables in this order:
 
-- It saves the destination in `local_meta` when the index has none yet.
+- It saves the destination in `local_meta` when the index has none yet. It does
+  so once it has written the marker file at the destination.
 - It deletes unfinished snapshots, and the rows that no snapshot uses.
 - It creates a row in `snapshots`, with `completed_at` set to `NULL`.
 - It deletes the `blobs` rows that were never uploaded.
@@ -379,8 +380,9 @@ It does not read the manifest.
 
 ### Prune
 
-`prune` first saves the destination in `local_meta` when the index has none yet.
-It then changes the local index in two ways:
+`prune` saves nothing in `local_meta`. It refuses to run when `local_meta` holds
+a different destination from the configured one. It changes the local index in
+two ways:
 
 - It deletes each snapshot whose manifest is gone from the destination.
 - It deletes unfinished snapshots, and the rows that no snapshot uses.