Add shared CI delivery command

docs/cli.md

@@ -1,6 +1,6 @@
 # Command line
 
-ReleaseKit currently provides five commands. The exit statuses below belong
+ReleaseKit currently provides six commands. The exit statuses below belong
 to the native executable. `go run` examples are convenient for source execution,
 but the Go driver maps a nonzero child exit status to 1. Use the built executable
 or `./scripts/release` for publication when distinct statuses are needed.
@@ -125,3 +125,30 @@ artifacts and retry with `--assets DIR`. Matching content is kept and only
 known missing assets are added. See the
 [delivery consumer guide](consumers/delivery.md) and
 [Gitea integration guide](integrations/gitea.md).
+
+Prepare a tagged CI checkout and deliver it:
+
+```sh
+releasekit ci-deliver [--repo DIR] [--config FILE] [--remote NAME] --commit OID VERSION
+```
+
+`ci-deliver` fetches `VERSION` from the selected Git remote (default `origin`),
+requires the tag's peeled commit to match the required full `--commit` object
+ID, and checks out that commit detached. It then loads the profile from the
+prepared checkout, validates delivery settings and the configured token, and
+downloads application dependencies only when the profile selects build targets.
+Binary profiles are built and delivered through the same facade path as
+`deliver`; source-only profiles skip dependency downloads and binary builds.
+`--config` follows the existing profile path rules: relative paths are resolved
+from `--repo`, and absolute paths are used as-is. This command explicitly
+prepares and changes the selected checkout. Ordinary `deliver` continues to
+operate on already prepared source without fetching, checking out, or
+downloading dependencies.
+
+In Woodpecker, pass `CI_WORKSPACE`, `CI_COMMIT_SHA`, and `CI_COMMIT_TAG` as the
+repository, expected commit, and version arguments. The CLI does not read
+provider-specific environment variable names. Checkout and dependency
+preparation failures return status 1; usage, profile, credential, and invalid
+version errors return status 2. Final delivery uses the same statuses as
+`deliver`: 0 for complete, 1 for known failure, conflict, or partial delivery,
+and 3 for uncertain remote state.

docs/config.md

@@ -48,6 +48,17 @@ retained for retries or when build and delivery credentials need separate
 invocations. Ordinary `deliver` does not download application dependencies or
 change the checkout.
 
+`ci-deliver` uses the same profile after preparing the selected tag in the
+checkout. It checks out the tag only after its peeled commit matches the
+provider-supplied commit ID, then loads the profile and validates delivery
+settings and credentials. It runs `go mod download` only when the profile has
+selected build targets; source-only delivery does not need application
+dependencies. This preparation may access the network and may update
+`go.sum`. The command takes CI values as arguments, so profile settings remain
+independent of Woodpecker environment variable names. See the
+[CI command contract](cli.md#prepare-a-tagged-ci-checkout-and-deliver-it) for
+the invocation and exit statuses.
+
 ReleaseKit's source-only profile is
 [releasekit.json](../releasekit.json).
 See the [source-only profile](../examples/releasekit.json) and

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # ReleaseKit audit implementation plan
 
-Status: Stages 1–8 complete; Stage 9 next.
+Status: Stages 1–9 complete; Stage 10 next.
 Baseline: `e4be7fa` (2026-10-06). The [audit](audit.md) records the evidence,
 product goals, and selected direction. This document owns implementation order
 and completion criteria for that work.
@@ -460,6 +460,16 @@ a wrong CI commit fails before application builds or hosted writes, and a
 source-only module with unavailable dependencies still reaches page delivery.
 Reuse facade tests for the individual preparation and delivery operations.
 
+**Completed:** `ci-deliver` now prepares the tagged checkout against the
+provider-supplied commit, loads the profile from that checkout, validates its
+delivery settings and credential, downloads dependencies only for selected
+binary targets, and finishes through the existing delivery facade. Local
+Git/HTTP fixtures cover source-only and binary delivery, relative custom profile
+loading, commit mismatch before Go or hosted requests, and unavailable
+source-only dependencies. CLI and configuration guidance describe preparation,
+provider arguments, effects, and exit statuses. The full offline suite, API
+boundary check, and documentation whitespace checks pass.
+
 ## Stage 10 — Consolidate and exercise maintained CI templates
 
 **Covers:** installation, workflow duplication, and artifact-testing in F6.