Read delivery tokens from files and check selected paths before release

docs/internal/validation.md

@@ -59,6 +59,10 @@ workspace-file check using the same candidate inventory. Resolved module bodies
 are parsed once per blob object ID; only owned filesystem-replacement targets
 and line numbers remain cached. Each declaration path receives findings from
 that summary in its own path context.
+The optional untracked-file check uses the captured tree's full path lookup
+before the other file checks. It normalizes the explicitly selected
+repository-relative names and reports matching entries through `untracked-files`
+without loading their blobs. Candidate-tree cleanup covers this failure path.
 The optional file-size check applies normalized literal file/directory
 exclusions with path-boundary matching, then requests local Git sizes for the
 remaining selected blobs. Sizes include symlink link-text bytes; gitlinks are