Add CLI reference binding flags

docs/config.md

@@ -121,6 +121,9 @@ Pipeline fields:
 - `artifacts`: required for pipeline resolution. It maps artifact lane IDs to
   lane definitions.
 - `output`: optional module binding. Default module is `json`.
+- `references`: optional map of extractor reference slot names to reference
+  paths. These bindings are defaults for artifact lanes whose extractor declares
+  the matching slot.
 
 Artifact lane fields:
 
@@ -129,11 +132,19 @@ Artifact lane fields:
 - `normalize`: optional module binding. Default module is `noop`.
 - `validators`: optional list of module bindings. The production CLI currently
   does not register validator modules.
+- `references`: optional map of extractor reference slot names to reference
+  paths. Lane bindings override pipeline-level bindings for the same slot.
 
 `notarius run` and `notarius config validate --pipeline` resolve the pipeline
 against the production module catalog and fail fast for unknown or incompatible
 module keys.
 
+Reference bindings are validated against extractor-declared slots during
+pipeline resolution. Required slots must be bound after config defaults,
+lane-level bindings, and run-time `--reference` or `--without-reference`
+overrides are applied. Reference paths are recorded in resolved pipeline
+metadata; the current runner does not read reference file content.
+
 ## Module Bindings
 
 Every module binding may use shorthand:
@@ -215,3 +226,5 @@ Pipeline resolution additionally checks:
 - required module keys are present;
 - module keys are registered for the expected slot;
 - module capability requirements are satisfied.
+- bound reference slots are declared by selected lane extractors;
+- required reference slots are bound for selected lanes.