Read delivery tokens from files and check selected paths before release

docs/consumers/check.md

@@ -98,6 +98,13 @@ The `Candidate` supplies both `RepositoryDir` and `ModuleDir`, plus the declared
 module-local product checks. ReleaseKit calls `AdditionalChecks` once after
 shared validation when supplied.
 
+For local token files, set `Validation.UntrackedFiles` to the repository-relative
+paths that should stay out of the committed candidate, such as
+`[]string{".releasekit/gitea-token"}`. Failures use `untracked-files` and carry the
+selected committed paths in `ValidationError.Findings`. This selection is
+independent of module and shared-file inputs; see [GoDoc](../../check.go) for
+the API contract and the [configuration reference](../config.md) for CLI use.
+
 `ValidationSpec.SharedFiles` adds committed, repository-relative files to
 ReleaseKit's optional file checks without enabling any checks. A nil slice
 selects the optional defaults `COPYRIGHT`, `LICENSE`, and