Add configuration inspection commands

docs/cli.md

@@ -181,6 +181,28 @@ OPENROUTER_API_KEY=validation-placeholder \
 The placeholder in the second command is sufficient only for offline
 validation; it cannot run a provider-backed pipeline.
 
+## config effective
+
+~~~
+notarius config effective [--config path/to/config.yml] [--config-profile name]
+~~~
+
+This command writes the selected composed configuration as deterministic,
+redacted YAML. Standard output contains only that YAML: it does not validate a
+pipeline, prepare modules, materialize references, or contact a provider.
+
+## config explain
+
+~~~
+notarius config explain [--config path/to/config.yml] [--config-profile name] <json-pointer>
+~~~
+
+This command writes ConfigKit's redacted, human-readable explanation for one
+canonical JSON Pointer. Supply `""` explicitly to explain the root. A malformed
+pointer is a syntax error; a well-formed unknown path is a command failure.
+The explanation can describe a value displaced by a selected profile. Standard
+output contains only the explanation.
+
 ## pipelines list
 
 ~~~
@@ -212,6 +234,6 @@ standard error. Parse the result only after the process exits with status 0.
 | 2 | The command or flag syntax was invalid, including unknown commands, missing required arguments, invalid flag values, or invalid flag combinations. |
 
 The root help spellings are the supported help path. Invoking **--help** on
-**run**, **config validate**, or **pipelines list** is handled by the flag
+**run**, a **config** subcommand, or **pipelines list** is handled by the flag
 parser as a usage error: it writes an error to standard error and exits with
 status 2.