Add public API boundary checks

docs/cli.md

@@ -0,0 +1,13 @@
+# Command line
+
+ReleaseKit currently provides one command:
+
+```sh
+go run ./cmd/releasekit version
+```
+
+It prints `releasekit <version>` followed by a newline and exits with status 0.
+The version comes from [`buildinfo.Version`](consumers/runtime-version.md).
+
+Any other argument sequence prints `usage: releasekit version` to standard
+error and exits with status 2.