Prepare self-bootstrap dependencies through normal Go access

docs/roadmap/remediation.md

@@ -1,12 +1,13 @@
 # ReleaseKit implementation remediation
 
-Status: One open v0.2.0 finding (9). Findings 1–8 are addressed.
+Status: All nine findings addressed.
 
 The v0.2.0 review covers committed state `edd670e` and the implementation
 commits after `89981ab`, against the [implementation plan](implementation.md),
 [feature roadmap](v0.2.0.md), [model roadmap](model.md), accepted ADRs, and
 applicable repository policies. Both ReleaseKit and Audita had clean worktrees
-when inspected. This review changes only this document.
+when inspected. The review changed only this document; the resolutions below
+record subsequent remediation.
 
 ## Foundation review history
 
@@ -285,10 +286,10 @@ tool through temporary module metadata. Audita's local wrapper and workflow
 adopt that approach in commit `17421bc`; the inspected declarations preserve
 its existing dependency version, image, secret name, and release profile.
 
-All ten feature areas are present. The three findings below identify incomplete
-behavior within Markdown validation and self-bootstrap. Finding 8 imposes
-unrequested existence/boundary checks on image alternative text. Finding 9
-effectively requires a prepopulated tool module cache. The review found no
+All ten feature areas are present. The review identified three behavior gaps
+within Markdown validation and self-bootstrap. Finding 8 imposed unrequested
+existence/boundary checks on image alternative text. Finding 9 effectively
+required a prepopulated tool module cache. The review found no
 additional public package, validator-registration framework, universal optional
 check, arbitrary inspection limit, or change to source-publication completion.
 
@@ -371,6 +372,16 @@ real linked images still report missing image sources and missing link targets.
 
 ## 9. P1: ReleaseKit's source-delivery bootstrap fails with an empty module cache
 
+**Resolution:** Addressed. Self-bootstrap uses normal Go dependency access for
+its readonly tool build after tag verification. The maintained workflow test
+starts with an empty module cache and a local HTTP module proxy, builds a tool
+with an external dependency, and verifies execution, clean tagged source, and
+temporary-output cleanup. A wrong commit stops before Go or proxy access. The
+regression failed before the fix and passed afterward. The delivery guide now
+describes tool dependency access and its separation from offline validation.
+The uncached offline suite, `go run ./internal/apicheck`, and local documentation
+link/fragment checks passed after all three fixes.
+
 **Owners:** [source-delivery workflow](../../examples/woodpecker/releasekit-source-delivery.yml),
 lines 27–31; [workflow verification](../../cmd/releasekit/woodpecker_test.go),
 `TestWoodpeckerSourceDeliveryTemplateSelfBootstraps`; and the
@@ -415,5 +426,5 @@ delivery tests retain ownership of hosted page behavior.
   Goldmark's renderer confirmed the alternative-text semantics. A separate
   temporary empty module cache reproduced finding 9. These probes are review
   evidence; production code and the committed test suite remain unchanged.
-- Existing tests pass but omit these cases. The required fixes remain open;
-  their remediation and regression coverage are subsequent work.
+- Existing tests passed but omitted these cases at review time. The resolutions
+  above record completed fixes and regression coverage.