Inspect committed workspace files

docs/internal/validation.md

@@ -25,6 +25,11 @@ symlink blobs, reports all unformatted paths, and stops with a contextual cause
 on parse or inspection errors. It runs before product checks and build callbacks.
 `Request.ReadCandidateTree` lets selected file checks request candidate
 contents; the Go-only path does not enumerate the tree.
+
+The workspace-file check uses that same candidate inventory and reports blob
+entries named go.work or go.work.sum, including nested paths and symlink blobs.
+It does not read workspace contents or depend on the workspace selected for Go
+commands.
 `CandidateTree` gets metadata and bytes from Git objects, reads blob bytes
 lazily, and resolves destinations without consulting the worktree or
 neighboring files.