Complete module release documentation

docs/config.md

@@ -9,7 +9,7 @@ The current profile fields are:
 | Field | Required | Behavior |
 | --- | --- | --- |
 | `product` | Yes | Product name used by release operations. |
-| `module_dir` | No | Repository-relative physical Go module directory; omission selects `.` (the repository root). |
+| `module_dir` | No | Repository-relative physical Go module directory with its own `go.mod`; omission selects `.` (the repository root). |
 | `remote` | No | Selected Git remote; defaults to `origin`. |
 | `expected_push_url` | No | Exact effective push URL required by `publish`; ignored by local `check`. |
 | `checks` | No | Ordered additional child commands, each with an argument vector and optional environment map. |
@@ -17,6 +17,13 @@ The current profile fields are:
 | `build` | No | Optional main package, binary name, and selected `GOOS/GOARCH` target strings. |
 | `delivery` | No | Optional Gitea `base_url`, `owner`, `repository`, and `token_env` settings for tagged-source delivery. |
 
+`module_dir` names the selected module's physical location in the repository;
+ReleaseKit reads its declared import path from that module's own `go.mod`. The
+physical directory and declared path are distinct: a declared `/v2` module can
+live either at `integrations/core` or `integrations/core/v2`, while both use the
+same full release tag. Root-only profiles can omit `module_dir` and do not need
+a module map.
+
 Each check requires a nonempty `args` array whose first element names the
 executable. Arguments are passed directly to the child process; ReleaseKit does
 not parse a shell command string. Select a shell explicitly when a check needs
@@ -30,10 +37,13 @@ target requires the package and binary name; each target is written as one
 
 The optional `validation` object selects shared checks implemented by ReleaseKit.
 `validation.shared_files` is a committed file list resolved from the repository
-root. Omission or `null` uses the optional defaults for enabled file checks;
-`[]` selects no shared files. Each explicit file must exist in the candidate,
-even when no file checks are enabled. Paths are literal and have no glob
-semantics. This field does not enable any checks.
+root. Omission or `null` uses `COPYRIGHT`, `LICENSE`, and
+`docs/oss/attribution.md` when present for enabled file checks; `[]` selects no
+shared files. An explicit list replaces those defaults. Each explicit file must
+exist in the candidate, even when no file checks are enabled. Paths are literal,
+repository-relative files with no glob semantics and may select a file outside
+the chosen module. ReleaseKit deduplicates them with module inputs by path. This
+field does not enable any checks.
 `validation.go.race` enables the race detector for the single standard Go test
 suite. `validation.go.full_vet` runs a separate native `go vet` pass after that
 suite succeeds; ReleaseKit disables test-time vet for that suite to avoid
@@ -191,8 +201,10 @@ credentials. An optional `--expected-module` checks a launcher's module
 selection against the profile. It runs `go mod download` only when the profile
 has selected build targets; source-only delivery does not need application
 dependencies. Default preparation may access the network and may update
-`go.sum`. The command takes CI values as arguments, so profile settings remain
-independent of Woodpecker environment variable names. See the
+`go.sum`. For binary tagged delivery, prepare and commit that module's sums
+before tagging so dependency preparation leaves the tagged checkout clean. The
+command takes CI values as arguments, so profile settings remain independent of
+Woodpecker environment variable names. See the
 [CLI contract](cli.md) for the invocation and exit statuses.
 
 This application dependency preparation is separate from bootstrapping the