Fix the import warning for allow-update { none; }; document CLI config paths

jarld import warned that zones with allow-update { none; } use dynamic
updates, though that turns them off (validation already allowed it).
docs/cli.md now gives the CLI configuration file's location on macOS and
Windows, not only ~/.config/jarl/config.yaml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/importer/importer.go

@@ -477,7 +477,7 @@ func (im *importer) zone(s *namedconf.Stmt, v *model.View) error {
 		}
 		report.Records, report.Skipped = n, skipped
 		for _, o := range opts {
-			if kw := o.Keyword(); kw == "allow-update" || kw == "update-policy" {
+			if kw := o.Keyword(); kw == "update-policy" || kw == "allow-update" && !allowsNone(o) {
 				im.warn("zone %s uses %s (dynamic updates); Jarl rewrites zone files and won't apply such zones until %s is removed", dnsname.Display(z.Name), kw, kw)
 			}
 		}
@@ -735,3 +735,18 @@ func ParseZoneText(zone, text string) (*ParsedZone, error) {
 	}
 	return pz, nil
 }
+
+// allowsNone says whether an address match list option is { none; }
+// (allow-update { none; } turns dynamic updates off).
+func allowsNone(o *namedconf.Stmt) bool {
+	b := o.FirstBlock()
+	if b == nil {
+		return false
+	}
+	for _, s := range b.Stmts {
+		if namedconf.Compact(s.Items) != "none" {
+			return false
+		}
+	}
+	return true
+}

internal/importer/importer_test.go

@@ -146,3 +146,22 @@ func TestParseTTL(t *testing.T) {
 		}
 	}
 }
+
+func TestImportAllowUpdateWarning(t *testing.T) {
+	dir := t.TempDir()
+	os.WriteFile(filepath.Join(dir, "x.db"), []byte("$TTL 300\n@ IN SOA ns1.x.test. h.x.test. 1 2 3 4 5\n@ IN NS ns1\nns1 IN A 192.0.2.1\n"), 0o644)
+	for conf, want := range map[string]bool{
+		`allow-update { none; };`:      false,
+		`allow-update { 127.0.0.1; };`: true,
+		`update-policy local;`:         true,
+	} {
+		os.WriteFile(filepath.Join(dir, "named.conf"), []byte(`zone "x.test" { type primary; file "`+dir+`/x.db"; `+conf+` };`), 0o644)
+		_, rep, err := Import(context.Background(), filepath.Join(dir, "named.conf"), Options{Alloc: seqAlloc()})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := len(rep.Warnings) > 0; got != want {
+			t.Errorf("%s: warnings = %v", conf, rep.Warnings)
+		}
+	}
+}