Add read-only configuration inspection commands

docs/config.md

@@ -42,6 +42,23 @@ The downloaded remote session file is command-scoped: Narratio removes it after
 the command finishes and records only the remote object provenance alongside
 the durable copied session input.
 
+### Read-only effective pipeline inspection
+
+`narratio config validate` and `narratio config show` use the same `--config`,
+`--campaign`, `--campaign-file`, and `--profile` selection rules as pipeline
+commands, but do not select, discover, or load a session. They do not read
+credential values or create runtime state.
+
+Campaign selection is optional only when the resolved pipeline has no
+`scriptorium.artifact_families`. When families are declared, Narratio selects a
+campaign through an explicit flag or `pipeline.campaigns.default_campaign_id`,
+then parses the campaign-owned party and expands concrete artifacts and any
+family publish rules before validation. `config validate` prints the resulting
+root, profile, and effective digest. `config show` emits the normalized
+effective pipeline YAML, with defaults and concrete expansion included but
+composition and family declarations omitted. The [CLI reference](cli.md#config-validate-and-config-show)
+owns command syntax and output conventions.
+
 ### Identity segments
 
 Campaign IDs (`campaign_id` and `default_campaign_id`), session IDs, previous