Map CLI profiles to selected modules

docs/cli.md

@@ -23,7 +23,7 @@ go run ./cmd/releasekit check [--repo DIR] [--config FILE] VERSION
 `VERSION` must use stable `vMAJOR.MINOR.PATCH` syntax. Options must precede the
 version. The repository defaults to the current directory, and the profile
 defaults to `<repository>/releasekit.json`. A successful command prints the
-captured local commit and version. It checks the committed release note and
+captured module, version, full tag, and commit. It checks the committed release note and
 local Git state, runs the standard offline Go test suite (with `-race` when
 `validation.go.race` is true), and runs a separate `go vet -mod=readonly ./...`
 pass after successful tests when `validation.go.full_vet` is true. It then runs
@@ -31,6 +31,15 @@ selected package compilation and committed Go formatting, followed by
 configured additional checks in profile order. It does not inspect remote
 availability or publish a tag.
 
+The profile's optional `module_dir` selects a repository-relative physical
+module directory; omission selects the root module. Validation and configured
+product checks use that module selection. Additional check commands run with
+the selected module as their working directory and receive
+`RELEASEKIT_VERSION`, `RELEASEKIT_CANDIDATE`, `RELEASEKIT_REPOSITORY_DIR`,
+`RELEASEKIT_MODULE_DIR`, `RELEASEKIT_MODULE_PATH`, and `RELEASEKIT_TAG` in their
+environment. These values are added to each child environment without changing
+the ReleaseKit process environment.
+
 When `validation.go.compile_targets` is selected, `check` compiles all packages
 for each configured `GOOS/GOARCH` pair after tests and full vet, using static
 mode with cgo disabled. This check produces no artifacts and does not execute
@@ -63,7 +72,7 @@ Unsupported argument sequences print usage to standard error.
 Publish a source tag:
 
 ```sh
-go run ./cmd/releasekit publish [--repo DIR] [--config FILE] VERSION
+go run ./cmd/releasekit publish [--repo DIR] [--config FILE] [--expected-module DIR] VERSION
 ```
 
 `publish` reads the same product, remote, validation, and additional-check
@@ -75,8 +84,8 @@ tests. Selected package compilation and committed Go formatting follow. The
 selected file checks then run in order: workspace files, local replacements,
 file size, and Markdown. Configured checks run afterward in profile order. It
 then creates an annotated local tag
-and pushes only its exact tag object. It prints the confirmed version,
-candidate commit, and tag object
+and pushes only its exact full tag object. It prints the confirmed semantic
+version, full tag, candidate commit, and tag object
 on success. Validation
 progress and failed publication state, including the captured publication
 endpoint for recovery, are written to standard error. A signal
@@ -113,6 +122,11 @@ It reports outside-checkout links to standard error unless boundary enforcement
 is selected; submodule contents remain out of scope. Markdown failures stop
 publication before product checks or tag creation.
 
+`--expected-module DIR` optionally checks a launcher's selected physical module
+against the profile's `module_dir` before candidate work. Both paths are
+normalized relative to the repository; the profile remains the source of module
+selection. The root selection is `.`.
+
 The optional profile field `expected_push_url` applies only to `publish`. A
 nonempty value must exactly match the effective push URL resolved by Git;
 mismatches fail during preflight before Go validation or tag creation. Git URL
@@ -136,8 +150,8 @@ go run ./cmd/releasekit build [--repo DIR] [--config FILE] [--output DIR] VERSIO
 targets with the requested version injected, checks the native `version`
 invocation, and writes binaries plus the private `.releasekit-build.json`
 receipt into `dist` by default. `--output` selects a different directory;
-relative paths are resolved from the repository. Selected artifact filenames
-are regenerated while unrelated files are preserved. A complete nonempty build
+relative paths are resolved from the selected module directory. Selected
+artifact filenames are regenerated while unrelated files are preserved. A complete nonempty build
 writes a receipt only after compilation and smoke checking succeed. On partial
 failure, standard error lists completed outputs and prior receipts in that
 output directory are invalidated; no new receipt is written. An