Add public API boundary checks

docs/consumers/runtime-version.md

@@ -0,0 +1,16 @@
+# Runtime version
+
+Applications can read their embedded version through the public `buildinfo`
+package:
+
+```go
+import "gitea.maximumdirect.net/eric/ReleaseKit/buildinfo"
+
+version := buildinfo.Version()
+```
+
+`Version` returns the identifier injected into the executable when present.
+Otherwise it returns the executable's main module version when that metadata is
+available and is not `(devel)`. It returns `dev` when neither source provides a
+release identifier. Applications should use this accessor for version output;
+the runtime implementation and ReleaseKit's builder own the injection detail.