Support full-tag prepared CI delivery

docs/cli.md

@@ -212,24 +212,31 @@ known missing assets are added. See the
 Prepare a tagged CI checkout and deliver it:
 
 ```sh
-releasekit ci-deliver [--repo DIR] [--config FILE] [--remote NAME] --commit OID VERSION
+releasekit ci-deliver [--repo DIR] [--config FILE] [--remote NAME] [--prepared] [--expected-module DIR] --commit OID TAG
 ```
 
-`ci-deliver` fetches `VERSION` from the selected Git remote (default `origin`),
-requires the tag's peeled commit to match the required full `--commit` object
-ID, and checks out that commit detached. It then loads the profile from the
-prepared checkout, validates delivery settings and the configured token, and
-downloads application dependencies only when the profile selects build targets.
-Binary profiles are built and delivered through the same facade path as
-`deliver`; source-only profiles skip dependency downloads and binary builds.
+`TAG` is the complete Git tag name, including any module path prefix. Its last
+path component must be a stable semantic version; other commands continue to
+take a semantic `VERSION`. By default, `ci-deliver` fetches the exact `TAG` from
+the selected Git remote (default `origin`), requires its peeled commit to match
+the required full `--commit` object ID, checks out that commit detached, then
+verifies the tag, HEAD, and clean worktree. With `--prepared`, it performs those
+checks read-only against the existing checkout and does not fetch or check out.
+In either mode, it loads the profile from the verified source. `--expected-module`
+optionally checks that the profile selects the module chosen by a launcher;
+module selection itself remains profile-owned. The command validates delivery
+settings and the configured token, then downloads application dependencies only
+when the profile selects build targets. Binary profiles are built and delivered
+through the same facade path as `deliver`; source-only profiles skip dependency
+downloads and binary builds.
 `--config` follows the existing profile path rules: relative paths are resolved
-from `--repo`, and absolute paths are used as-is. This command explicitly
-prepares and changes the selected checkout. Ordinary `deliver` continues to
-operate on already prepared source without fetching, checking out, or
-downloading dependencies.
+from `--repo`, and absolute paths are used as-is. The default mode prepares and
+changes the selected checkout; `--prepared` reuses a verified checkout.
+Ordinary `deliver` continues to operate on already prepared source without
+fetching, checking out, or downloading dependencies.
 
 In Woodpecker, pass `CI_WORKSPACE`, `CI_COMMIT_SHA`, and `CI_COMMIT_TAG` as the
-repository, expected commit, and version arguments. The CLI does not read
+repository, expected commit, and full tag arguments. The CLI does not read
 provider-specific environment variable names. Checkout and dependency
 preparation failures return status 1; usage, profile, credential, and invalid
 version errors return status 2. Final delivery uses the same statuses as

docs/config.md

@@ -180,12 +180,17 @@ retained for retries or when build and delivery credentials need separate
 invocations. Ordinary `deliver` does not download application dependencies or
 change the checkout.
 
-`ci-deliver` uses the same profile after preparing the selected tag in the
-checkout. It checks out the tag only after its peeled commit matches the
-provider-supplied commit ID, then loads the profile and validates delivery
-settings and credentials. It runs `go mod download` only when the profile has
-selected build targets; source-only delivery does not need application
-dependencies. This preparation may access the network and may update
+`ci-deliver` takes a full Git `TAG`; its final path component is the stable
+semantic version and the complete value is checked against the profile's
+derived tag. By default it fetches the selected tag, confirms its peeled commit
+matches the provider-supplied commit ID, checks it out detached, and verifies
+the tag, HEAD, and clean worktree. With `--prepared`, it performs the same
+checks against an existing checkout without fetching or checking out. It then
+loads the profile from that source and validates delivery settings and
+credentials. An optional `--expected-module` checks a launcher's module
+selection against the profile. It runs `go mod download` only when the profile
+has selected build targets; source-only delivery does not need application
+dependencies. Default preparation may access the network and may update
 `go.sum`. The command takes CI values as arguments, so profile settings remain
 independent of Woodpecker environment variable names. See the
 [CLI contract](cli.md) for the invocation and exit statuses.

docs/roadmap/implementation.md

@@ -585,6 +585,17 @@ dirty source, missing/moved tag, and inconsistent profile module. Verify detache
 historical delivery, module-targeted dependencies for binaries, and page-only
 application-preparation omission. Run preparation and CLI delivery tests.
 
+**Completed:** CI delivery now accepts literal full tags and derives the stable
+semantic version from the final path component. Tagged checkout preparation
+shares read-only tag, HEAD, expected-commit, and cleanliness verification with
+the offline `--prepared` mode. CI profiles load from that checkout, optional
+`--expected-module` is compared before application dependency preparation, and
+the event tag is passed through delivery for exact identity checks. Binary
+dependency preparation remains module-targeted and page-only profiles skip it.
+Verified nested tag preparation, prepared CLI delivery without a remote, wrong
+commit and dirty/missing/moved tag rejection, profile parsing, full `go test
+./...`, `go run ./internal/apicheck`, and `git diff --check`.
+
 ## Stage 12: Preserve the small root-module workflow
 
 **Outcome:** Existing root-only consumers retain a small launcher, profile, and