Apply module scope to file validation checks

docs/consumers/publish.md

@@ -62,9 +62,10 @@ are ignored, and Go workspace selection and vendor behavior are unchanged. Its
 zero value disables the check. Findings use `workspace-files` and stop
 publication before product checks or tag creation.
 Set `Validation.ModuleDistribution.LocalReplacements` independently to parse
-committed `go.mod` declarations across the candidate, including nested and
-vendor modules. Filesystem `replace` directives are reported with their source
-path, line, and target as `local-replacements`; versioned replacements are
+selected module's committed `go.mod` declarations. Vendored contents remain in
+scope, while independently released nested modules are excluded. Filesystem
+`replace` directives are reported with their source path, line, and target as
+`local-replacements`; versioned replacements are
 permitted. Committed module symlinks are resolved within the candidate, and
 parse or inspection errors retain their causes. This check is independent of
 `GOWORK`; its zero value disables it, and a failure stops publication before
@@ -72,9 +73,9 @@ product checks or tag creation.
 Set `Validation.FileSize` to check each committed blob against a byte limit.
 Nil disables the check; an empty object enables the default of 1,000,000
 decimal bytes. `LimitBytes` uses strict greater-than, accepts zero, and rejects
-negative values. `Exclusions` contains literal repository-relative files or
-directories, including committed descendants of excluded directories. Symlink
-blob size is its link text; gitlinks are omitted. This check measures only the
+negative values. `Exclusions` contains literal files or directories relative to
+the selected module, including committed descendants of excluded directories.
+Symlink blob size is its link text; gitlinks are omitted. This check measures only the
 captured candidate and reports one oversized file with its measurement as
 `file-size`; it stops publication before product checks or tag creation.