Add source publication command and runbook

docs/cli.md

@@ -1,6 +1,6 @@
 # Command line
 
-ReleaseKit currently provides two commands.
+ReleaseKit currently provides three commands.
 
 Print the executable version:
 
@@ -24,7 +24,28 @@ captured local commit and version. It checks the committed release note, local
 Git state, and configured validation, but does not inspect remote availability
 or publish a tag.
 
-Both commands write errors and diagnostic output to standard error. `check`
-returns status 0 after local validation, 1 after a candidate validation failure,
-and 2 for usage, profile, or invalid-version errors. Unsupported argument
-sequences print usage to standard error.
+`check` writes errors and diagnostics to standard error. It returns status 0
+after local validation, 1 after a candidate validation failure, and 2 for usage,
+profile, or invalid-version errors. Unsupported argument sequences print usage
+to standard error.
+
+Publish a source tag:
+
+```sh
+go run ./cmd/releasekit publish [--repo DIR] [--config FILE] VERSION
+```
+
+`publish` reads the same product, remote, and validation settings as `check`.
+It validates the candidate once, checks the authoritative remote, creates an
+annotated local tag, and pushes only its exact tag object. It prints the
+confirmed version, candidate commit, and tag object on success. Validation
+progress and failed publication state are written to standard error. A signal
+cancels the active operation; if it arrives during a push, the library's
+bounded reconciliation determines whether the exact tag was accepted.
+
+The command returns status 0 for confirmed publication, 1 for a known
+publication failure or conflict, 2 for usage, profile, or invalid-version
+errors, and 3 when the push outcome remains unknown. Unknown status must be
+resolved against the authoritative remote before retrying. The
+[maintainer procedure](release.md) selects the repository profile and gives
+the source-release workflow.