Correct doc and help sentences that are false about the code (closes #233)

A blob is written in full to a temporary file in $TMPDIR and uploaded
once finished, not streamed to storage; the README and
config.example.yml now say a backup needs about blob_size_limit of free
space there. Also corrected: the snapshot ID format, what restore reads
and how incomplete snapshots are removed in docs/DATAMODEL.md, what
source_path is for, the index_path default, the config search order in
the snapshot create help, what snapshot remove cleans up in the prune
help, how the release installs Go, and the script/release and
script/fmt-check comments.

The source_path claim is also corrected in models.go, scanner.go and
001.sql, which the issue did not list.

Model: opus-5-5

README.md

@@ -546,7 +546,7 @@ complete annotated example also lives in
 | `s3.*` | | Legacy S3 configuration (endpoint, bucket, credentials) |
 | `exclude` | | Global exclude patterns (applied to all snapshots) |
 | `chunk_size` | `10MB` | Average chunk size for content-defined chunking |
-| `blob_size_limit` | `10GB` | Maximum blob size before splitting. Must be at least four times `chunk_size` (the largest chunk the chunker can emit), otherwise a single-chunk blob could exceed the limit |
+| `blob_size_limit` | `10GB` | Maximum blob size before splitting. Must be at least four times `chunk_size` (the largest chunk the chunker can emit), otherwise a single-chunk blob could exceed the limit. Each blob is written in full to a temporary file in `$TMPDIR` (`/tmp` when unset) before it is uploaded, so a backup needs about this much free space there |
 | `compression_level` | `3` | zstd compression level (1-19) |
 | `hostname` | system hostname | Hostname used in snapshot IDs |
 | `index_path` | platform data dir | Local SQLite index path |
@@ -805,7 +805,8 @@ them. We provide:
   in the `Dockerfile` together.
 * `script/release` — cross-compile and publish the release artifacts
   with the pinned `goreleaser`. Refuses a `goreleaser` on `PATH` whose
-  version is not the pinned one, on the same reasoning as `script/lint`.
+  version is not the pinned one, because a different version would build
+  a different release from the same tag.
 * `script/release-snapshot` — the same build with no publishing and no
   tagging, into `./dist`
 * `script/test` — run the test suite by building the `test` phase of
@@ -915,14 +916,14 @@ It is passed to `goreleaser` as `GITEA_TOKEN`. The runner's automatic
 token is deliberately not used: it is not guaranteed to carry release
 write access.
 
-The Go toolchain that compiles the released binaries comes from an
-`actions/setup-go` step pinned by commit sha, reading its version from
-`go.mod` (currently `1.26.1`, the same version the `Dockerfile` builder
-stage pins by digest). `goreleaser` shells out to `go` for every
+The Go toolchain that compiles the released binaries is installed by
+`script/install-go`, which downloads the version named by `go.mod`
+(currently `1.26.1`, the same version the `Dockerfile` builder stage
+pins by digest) and refuses the archive unless its sha256 matches the
+value committed in the script. `goreleaser` shells out to `go` for every
 cross-compile, so without that step the release would either fail
 outright or ship binaries built by whatever unpinned toolchain the
-runner happened to carry — the one unpinned thing in an otherwise
-hash-pinned release path.
+runner happened to carry.
 
 To rehearse the whole build without publishing or tagging anything: