Fix the import warning for allow-update { none; }; document CLI config paths

jarld import warned that zones with allow-update { none; } use dynamic
updates, though that turns them off (validation already allowed it).
docs/cli.md now gives the CLI configuration file's location on macOS and
Windows, not only ~/.config/jarl/config.yaml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -44,8 +44,19 @@ jarl whoami
 | Changeset to stage into | `-C/--changeset` | `JARL_CHANGESET` | |
 
 Flags win over the environment, and the environment wins over the file. The
-file is `~/.config/jarl/config.yaml` (mode 0600), or `--config` /
-`JARL_CLI_CONFIG`. `jarl config show` prints it with the token masked.
+file is `jarl/config.yaml` in the user's configuration directory, or
+`--config` / `JARL_CLI_CONFIG`:
+
+| System | File |
+|--------|------|
+| Linux and other Unix | `~/.config/jarl/config.yaml` (`$XDG_CONFIG_HOME/jarl/config.yaml` if set) |
+| macOS | `~/Library/Application Support/jarl/config.yaml` |
+| Windows | `%AppData%\jarl\config.yaml` (`C:\Users\<you>\AppData\Roaming\jarl\config.yaml`) |
+
+It is written with mode 0600 (on Windows, the AppData folder is already
+private to the user). `jarl config show` prints its path and the settings,
+with the token masked. On Windows and macOS there is no local jarld, so
+always set a server.
 
 Get tokens from the web UI (Account → API tokens), from
 `jarl token create`, or from `jarld init --token` on the server.

docs/install.md

@@ -322,7 +322,8 @@ jarl status
 jarl zone list
 ```
 
-The CLI's settings are stored in `~/.config/jarl/config.yaml` (mode 0600).
+The CLI's settings are stored in `~/.config/jarl/config.yaml` (mode 0600;
+macOS and Windows use their own folders, see [cli.md](cli.md#setup)).
 `JARL_SERVER` and `JARL_TOKEN` override them, which is handy in scripts.
 Create more tokens in the web UI (Account → API tokens) or with
 `jarl token create NAME`. See [cli.md](cli.md).