Keep committed release note reads offline

docs/internal/validation.md

@@ -107,6 +107,7 @@ Committed-tree metadata and blob reads disable lazy fetching and Git transports
 for those child commands. Missing local objects produce inspection errors;
 source preparation retains its separate network-capable operations. See Git's
 [lazy-fetch controls](https://git-scm.com/docs/git) for the command mechanism.
+Candidate and delivery release-note reads use the same local object boundary.
 
 Public validation errors convert their diagnostic fields to the internal
 failure model for shared formatting. Converted failures retain their original