Read delivery tokens from files and check selected paths before release

docs/release.md

@@ -14,6 +14,15 @@ succeeded. CI and consumer installation are not completion checks.
 
 ## Prepare a candidate
 
+For local hosted-page delivery, save a Gitea personal access token in
+`.releasekit/gitea-token` with owner-only file permissions. The file contains
+only the token. ReleaseKit's profile selects this file as a fallback to
+`RELEASEKIT_GITEA_TOKEN`; `.releasekit/` is already ignored. Its optional
+`validation.untracked_files` selection checks that this path is absent from the
+committed candidate. Source publication requires no delivery token. The
+[configuration reference](config.md) owns credential selection and validator
+semantics.
+
 Use a clean clone on `main`. The chosen build toolchain is Go 1.26.10. Make that
 local installation the active `go` command for preparation, building the release
 executable, and candidate validation:
@@ -150,7 +159,15 @@ git checkout --detach "vX.Y.Z"
 GOTOOLCHAIN=local go mod download
 mkdir -p .releasekit/bin
 GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off go build -o .releasekit/bin/releasekit ./cmd/releasekit
-RELEASEKIT_GITEA_TOKEN="$GITEA_TOKEN" .releasekit/bin/releasekit deliver "vX.Y.Z"
+.releasekit/bin/releasekit deliver "vX.Y.Z"
+```
+
+For an older tag whose CLI predates `token_file`, supply the token through its
+environment variable when retrying that tagged tool:
+
+```sh
+RELEASEKIT_GITEA_TOKEN="$(cat .releasekit/gitea-token)" \
+  .releasekit/bin/releasekit deliver "vX.Y.Z"
 ```
 
 The root ignore file excludes `.releasekit/`. Delivery uses the committed note