Correct doc and help sentences that are false about the code (closes #233)

A blob is written whole to a temporary file and uploaded once finished,
not streamed to storage. The README, ARCHITECTURE.md and
config.example.yml now say a backup needs free temporary space for each
blob (twice that for an rclone destination that cannot stream uploads)
and for the metadata export's copies of the local index, in $TMPDIR, or
partly in /var/tmp when TMPDIR is unset. Also corrected: the snapshot ID
format, what restore reads and how incomplete snapshots are removed in
docs/DATAMODEL.md, what source_path holds, the index_path default, the
config search order in the snapshot create help, what snapshot remove
cleans up in the prune help, how the release installs Go, and the
script/release and script/fmt-check comments.

Model: opus-5-5

script/fmt-check

@@ -1,6 +1,9 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
+# script/fmt-check: check formatting (read-only). Fails instead of
+# writing. It checks every Go file outside .tool, which is more than
+# script/fmt formats: `go fmt ./...` skips `testdata` directories and
+# files and directories whose names start with `.` or `_`. Fix a file
+# only this reports with `gofmt -w`.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/release

@@ -21,10 +21,9 @@ goreleaser_version() {
         head -n 1
 }
 
-# Resolve the goreleaser to run, on the same rule script/lint uses for
-# golangci-lint: a binary on PATH is accepted only when it is exactly
-# the pinned version, because a differently versioned tool would
-# produce a differently built release from the same tag. Anything else
+# Resolve the goreleaser to run. A binary on PATH is accepted only when
+# it is exactly the pinned version, because a differently versioned tool
+# would produce a differently built release from the same tag. Anything else
 # comes from .tool/bin, and a missing one is a loud failure naming the
 # script that installs it rather than a silent fallback.
 resolve_goreleaser() {