Check expected publication push URL

docs/cli.md

@@ -71,6 +71,12 @@ after tests and full vet and before configured checks. Each failure is reported
 as `package-compile` with its selected target; this does not create build
 artifacts or execute target binaries.
 
+The optional profile field `expected_push_url` applies only to `publish`. A
+nonempty value must exactly match the effective push URL resolved by Git;
+mismatches fail during preflight before Go validation or tag creation. Git URL
+rewrites are resolved first, and the push URL is used when fetch and push URLs
+differ. `check` ignores this field.
+
 The command returns status 0 for confirmed publication, 1 for a known
 publication failure or conflict, 2 for usage, profile, or invalid-version
 errors, and 3 when the push outcome remains unknown. Unknown status must be