Document distributor notification behavior

docs/config.md

@@ -78,8 +78,10 @@ missing directories, and unreadable files fail config loading.
 
 ### `notify`
 
-`notify.distributor` is validated configuration for distributor notification.
-It is disabled by default. This configuration does not add CLI flags.
+`notify.distributor` controls distributor notification after successful report
+generation. It is disabled by default and does not add CLI flags. When enabled,
+weatherreporter uploads one distributor bundle per generated report after
+`scriptorium run` succeeds and final metadata is saved.
 
 - `enabled`: whether distributor notification config is active. Default:
   `false`.
@@ -105,6 +107,10 @@ Rendered report paths must be relative paths with `/` separators. They must not
 contain backslashes, empty path segments, `.`, `..`, `manifest.json`, or
 `.distributor.json`.
 
+The upload token is read from the environment variable named by `token_env`
+after config loading and `secrets.directory` processing. Config files should
+name the variable only; they should not contain the token value.
+
 ### `missing_source`
 
 - `default`: missing-source behavior for optional sources. One of `error`, `warn`, or `none`. Default: `warn`.
@@ -158,7 +164,11 @@ snapshot exists and a threshold is crossed.
 
 Configuration files should not contain raw secrets. Use `secrets.directory` to
 load secret values from files into environment variables for integrations that
-read credentials from the environment.
+read credentials from the environment. Secret file names become environment
+variable names, and secret file contents become values. For distributor
+notification, this allows a file such as
+`<secrets.directory>/DISTRIBUTOR_UPLOAD_TOKEN` to supply the token referenced by
+`notify.distributor.token_env`.
 
 ## Maintained Examples