Fix two misleading messages (closes #240)

The warning for a config file that others can read always said the
file contained S3 credentials, so a file:// config with none got a
false claim. It now names them only when s3.access_key_id or
s3.secret_access_key is set, and otherwise says the file is readable
by others.

snapshot purge wrapped the listing error, which already starts with
"listing remote snapshots:", in that prefix a second time.
syncWithRemote now returns it unwrapped, as CleanupLocalSnapshots
does.

Judgement call: a credential pulled into the config through smartconfig
substitution counts as set by the file.

Model: opus-5-5

TODO.md

@@ -22,6 +22,16 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-07: Made two messages say only what is true
+  ([issue #240](https://git.eeqj.de/sneak/vaultik/issues/240)). A config
+  file that others can read was warned about as containing S3
+  credentials even when it set none, as a `file://` config does. The
+  warning now names the credentials only when `s3.access_key_id` or
+  `s3.secret_access_key` is set, and otherwise says the file is readable
+  by others. `snapshot purge` against a destination store it could not
+  list gave an error with `listing remote snapshots:` in it twice; the
+  prefix now appears once.
+
 - 2026-10-07: Made per-name retention work when the hostname contains `_`
   ([issue #230](https://git.eeqj.de/sneak/vaultik/issues/230)). A
   snapshot ID is `hostname_name_timestamp`, and the name was read as