Complete audit remediation and verification

docs/consumers/delivery.md

@@ -48,8 +48,8 @@ acted as the selection base. Outside a checkout, the supplied directory remains
 the base for `ModuleDir`.
 Preparation overrides an alternate module file selected by `GOFLAGS`, while
 retaining other effective Go settings. The operation may use the network and
-updates the Go module cache while
-preserving the caller's proxy, private-module, credential, and cache settings.
+updates the Go module cache while preserving the caller's proxy, private-module,
+credential, and cache settings.
 If checksums are missing, Go may update `go.sum`. For binary CI delivery, prepare
 and commit the selected module's `go.sum` before tagging: delivery verifies the
 tagged source remains clean after dependency preparation. See the
@@ -223,9 +223,9 @@ credential preflight, verifies the local artifacts in full, and then makes
 hosted writes. The current files are checked against their recorded digests
 before those writes. Preflight confirms only the access evidence available from
 the service, as described above. The files remain caller-owned, so callers can
-retain the original bytes for retries and are responsible for cleanup. With neither
-artifact source, an empty managed target set, or a matching empty prebuilt
-result, delivery is page-only. A prebuilt result with no targets or artifacts
+retain the original bytes for retries and are responsible for cleanup. With
+neither artifact source, an empty managed target set, or a matching empty
+prebuilt result, delivery is page-only. A prebuilt result with no targets or artifacts
 must still identify the matching repository, module directory and path, tag,
 commit, and version; a zero `BuildResult` does not. Do not set both `Build` and
 `Prebuilt` in one request.