Expose Markdown validation selection

docs/cli.md

@@ -44,6 +44,14 @@ modifying files. When `validation.module_distribution.workspace_files` is true,
 and symlink entries, as `workspace-files`. This inspection is independent of
 `GOWORK` and ignores uncommitted files. Any artifact build selected by the
 separate `build` setting runs after shared validation and configured checks.
+When `validation.markdown` is a non-null object, `check` checks committed local
+Markdown destinations and supported heading fragments after file-size
+inspection. An empty object enables the check; omission or `null` disables it.
+Outside-checkout links are written as out-of-scope observations to standard
+error by default. Setting `validation.markdown.enforce_checkout_boundary` to
+true makes those links fail; submodule-content observations remain
+nonfailures. Failures use the `markdown-links` identity with the source location
+and target.
 
 `check` writes errors and diagnostics to standard error. It returns status 0
 after local validation, 1 after a candidate validation failure, and 2 for usage,
@@ -64,8 +72,9 @@ candidate: the single standard offline Go test suite runs first, with `-race`
 when `validation.go.race` is true. When `validation.go.full_vet` is true,
 test-time vet is disabled and `go vet -mod=readonly ./...` runs after successful
 tests. Selected package compilation and committed Go formatting follow. The
-selected workspace-file check then runs, followed by configured checks in
-profile order. It then creates an annotated local tag
+selected file checks then run in order: workspace files, local replacements,
+file size, and Markdown. Configured checks run afterward in profile order. It
+then creates an annotated local tag
 and pushes only its exact tag object. It prints the confirmed version,
 candidate commit, and tag object
 on success. Validation
@@ -97,6 +106,11 @@ disables the check; an empty object enables the 1,000,000 decimal-byte default.
 Oversized files use the `file-size` identity and report their path and measured
 size against the limit. See the [configuration reference](config.md) for
 literal exclusions and the current-candidate scope.
+When `validation.markdown` is a non-null object, `publish` checks committed
+Markdown destinations after file-size inspection and before configured checks.
+It reports outside-checkout links to standard error unless boundary enforcement
+is selected; submodule contents remain out of scope. Markdown failures stop
+publication before product checks or tag creation.
 
 The optional profile field `expected_push_url` applies only to `publish`. A
 nonempty value must exactly match the effective push URL resolved by Git;