Add stage-local reference config bindings

docs/config.md

@@ -135,8 +135,8 @@ Artifact lane fields:
 - `normalize`: optional module binding. Default module is `noop`.
 - `validators`: optional list of module bindings. The production CLI currently
   does not register validator modules.
-- `references`: optional map of extractor reference slot names to reference
-  paths. Lane bindings override pipeline-level bindings for the same slot.
+- `references`: optional compatibility alias for extractor reference bindings.
+  Lane bindings override pipeline-level bindings for the same slot.
 
 `notarius run` and `notarius config validate --pipeline` resolve the pipeline
 against the production module catalog and fail fast for unknown or incompatible
@@ -144,15 +144,15 @@ module keys.
 
 Reference bindings are validated against extractor-declared slots during
 pipeline resolution. Required slots must be bound after config defaults,
-lane-level bindings, and run-time `--reference` or `--without-reference`
-overrides are applied. Config-relative paths are resolved relative to the
-config file; CLI reference paths are resolved relative to the current working
-directory. Bound files must be UTF-8 text and are passed only to lane
-extractors that declare the slot. Reference media types are inferred from file
-extensions, recorded as canonical base media types, and checked only when a
-module declares `AcceptedMediaTypes`; unknown extensions are recorded as
-`application/octet-stream`. Reference content is not written to diagnostics,
-logs, errors, or manifests.
+extractor binding references, lane-level compatibility bindings, and run-time
+`--reference` or `--without-reference` overrides are applied. Config-relative
+paths are resolved relative to the config file; CLI reference paths are resolved
+relative to the current working directory. Bound files must be UTF-8 text and
+are passed only to lane extractors that declare the slot. Reference media types
+are inferred from file extensions, recorded as canonical base media types, and
+checked only when a module declares `AcceptedMediaTypes`; unknown extensions are
+recorded as `application/octet-stream`. Reference content is not written to
+diagnostics, logs, errors, or manifests.
 
 Pipeline-level `references` are defaults. They are valid when at least one
 declared lane in the pipeline has an extractor that declares the slot. During a
@@ -170,7 +170,9 @@ pipelines:
         extract: dnd/spells
 ```
 
-Lane-level `references` override or add bindings for one lane:
+Extractor binding `references` are the canonical lane-local location. The
+legacy lane-level `references` field remains supported as an alias; when both
+bind the same slot, `extract.references` wins:
 
 ```yaml
 pipelines:
@@ -180,11 +182,19 @@ pipelines:
       glossary: ./campaign/glossary.txt
     artifacts:
       spells:
-        extract: dnd/spells
         references:
-          roster: ./campaign/session-roster.txt
+          roster: ./campaign/legacy-roster.txt
+        extract:
+          module: dnd/spells
+          references:
+            roster: ./campaign/session-roster.txt
 ```
 
+`chunk.references` and `normalize.references` are accepted in object-form
+bindings and preserved in the effective configuration. They are validated as
+reference maps, but current reference materialization still delivers content
+only to extractor bindings.
+
 ## Module Bindings
 
 Every module binding may use shorthand:
@@ -208,6 +218,9 @@ Binding fields:
 - `module`: module key.
 - `llm_profile`: optional LLM profile ID. Empty means `default`.
 - `options`: optional module-specific settings.
+- `references`: optional reference bindings. Supported only for `chunk`,
+  `extract`, and `normalize` bindings. `input`, `merge`, validator, and
+  `output` bindings reject this field during validation.
 
 The `--llm-profile` run flag overrides every effective module binding to use
 one configured profile.