Load a config that has no age recipient (closes #221)

The README's steps for restoring on another machine failed at the first
command: `config init` wrote a placeholder recipient, and `config.Load`
rejects any recipient that does not parse. `config init` now writes an
empty `age_recipients` list, `config.Load` accepts an empty list, and
`snapshot create` refuses to start without a recipient. A malformed
recipient is still rejected at load.

The recovery-host test now builds its config with `config init` and
`config set` and reads it through `config.Load`, so it imports
`internal/cli`. On a fresh file, `config set age_recipients.0` writes the
list in flow style (`[age1...]`).

Model: opus-5-5

internal/vaultik/restore_another_machine_test.go

@@ -170,7 +170,9 @@ func newRecoveryHost(
 }
 
 // runVaultikCommand runs one vaultik command line in-process and fails the
-// test if it returns an error.
+// test if it returns an error. The command writes the cli package's global
+// flag variables, so it must not be called from two tests that run at the
+// same time.
 func runVaultikCommand(t *testing.T, args ...string) {
 	t.Helper()