Fix two misleading messages (closes #240)

The warning for a config file that others can read always said the
file contained S3 credentials, so a file:// config with none got a
false claim. When s3.access_key_id or s3.secret_access_key is set it
now says the file may contain them, because Load sees the values only
after smartconfig has replaced any ${...} reference, so a set
credential need not be in the file. Otherwise it says the file is
readable by others.

snapshot purge wrapped the listing error, which already starts with
"listing remote snapshots:", in that prefix a second time.
syncWithRemote now returns it unwrapped, as CleanupLocalSnapshots
does.

Model: opus-5-5

TODO.md

@@ -22,6 +22,17 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-07: Made two messages say only what is true
+  ([issue #240](https://git.eeqj.de/sneak/vaultik/issues/240)). A config
+  file that others can read was warned about as containing S3
+  credentials even when it set none, as a `file://` config does. The
+  warning now says the file may contain S3 credentials only when
+  `s3.access_key_id` or `s3.secret_access_key` is set, since either may
+  come from a `${...}` reference rather than the file, and otherwise
+  says the file is readable by others. `snapshot purge` against a
+  destination store it could not list gave an error with
+  `listing remote snapshots:` in it twice; the prefix now appears once.
+
 - 2026-10-07: Made per-name retention work when the hostname contains `_`
   ([issue #230](https://git.eeqj.de/sneak/vaultik/issues/230)). A
   snapshot ID is `hostname_name_timestamp`, and the name was read as