Add application configuration inspection commands

docs/cli.md

@@ -25,6 +25,9 @@ go run ./cmd/scriptorium render \
 - `scriptorium serve`: start the HTTP server.
 - `scriptorium inspect prompt`: inspect one prompt definition without model execution.
 - `scriptorium inspect profile`: inspect one effective profile without model execution.
+- `scriptorium config validate`: validate application configuration without building an engine.
+- `scriptorium config show`: show the resolved application configuration.
+- `scriptorium config sources`: show the ordered configuration sources.
 
 All commands accept `--config <path>` and `--config-overlay <name>` and reject
 positional arguments. `--config-overlay` selects one application configuration
@@ -217,6 +220,37 @@ resolves profile inheritance and backend defaults, but never reads a credential
 value, loads a prompt, reserves capacity, or calls a model. Unset provider
 controls are shown as zero values when Promptkit leaves them unspecified.
 
+## Application configuration inspection
+
+```text
+scriptorium config validate [flags]
+scriptorium config show [flags]
+scriptorium config sources [flags]
+```
+
+Each accepts `--config`, `--config-overlay`, `--prompt-dir`, `--profile-dir`,
+`--schema-dir`, `--addr`, `--artifact-root`, `--max-request-bytes`,
+`--max-artifact-bytes`, and `--max-response-bytes`. These are application
+configuration selectors and overrides; request, credential, backend-editing,
+output-format, and output-file flags are not accepted. Positional arguments
+are rejected.
+
+`validate` writes no success output; status 0 means the application configuration
+loaded and passed its own validation. It does not establish that a prompt
+directory exists, credentials are present, or Promptkit can construct an
+engine. `show` writes ConfigKit's resolved, redacted YAML snapshot. `sources`
+writes one newline-terminated JSON array of source records in load order. Each
+record has `id`, `label`, and `layer`, plus `path` when available; explicit CLI
+overrides appear as synthetic sources. Defaults-only input without overrides
+produces `[]` for `sources`.
+
+Diagnostics and warnings go to stderr, never into successful stdout. Parse,
+load, output, and diagnostic-write failures exit 1. Ordinary output writes may
+leave partial data on failure. The inspection output can contain paths,
+identifiers, `api_key_env` reference names, and ordinary `extra_params` values;
+protect it accordingly. Raw API-key values are not read or emitted by these
+commands.
+
 ## Input And Variable Syntax
 
 `--input name=path` maps an input name to a local file; `--var name=value`