Document neutral forge delivery and preflight

docs/consumers/delivery.md

@@ -1,6 +1,8 @@
 # Deliver a tagged source release
 
 Use `releasekit.Deliver` or the `deliver` command after a source tag exists.
+Select the delivery backend explicitly in the profile or
+`DeliveryDestination`; the destination URL does not infer a backend.
 Delivery status is separate from source publication: a delivery problem does
 not move or remove the tag, and a retry can use the same immutable version.
 The operation accepts historical lightweight and annotated tags, including a
@@ -62,6 +64,7 @@ Add a Gitea destination to the profile:
 {
   "product": "Example",
   "delivery": {
+    "forge": "gitea",
     "base_url": "https://gitea.example",
     "owner": "example",
     "repository": "example",
@@ -93,6 +96,7 @@ as `.releasekit/gitea-token` and configure:
     "forbidden_files": [".releasekit/gitea-token"]
   },
   "delivery": {
+    "forge": "gitea",
     "base_url": "https://gitea.example",
     "owner": "example",
     "repository": "example",
@@ -129,8 +133,9 @@ directory must contain the private `.releasekit-build.json` receipt created by
 `build`. ReleaseKit checks its schema, repository, commit, version, resolved
 module directory and path, full tag, normalized build settings, and artifact
 declarations. Old receipts must be regenerated with the updated `build`
-command. Delivery verifies the artifact bytes and sizes before making a hosted
-request; caller-owned files remain available for retries.
+command. Delivery verifies the artifact bytes and sizes after read-only
+preflight and before any hosted write; caller-owned files remain available for
+retries.
 Ordinary `deliver` does not download application dependencies or change the
 checkout.
 
@@ -150,13 +155,57 @@ published content needs correction. If rebuilding could change bytes already
 on the server, retain the original build output and retry with `--assets DIR`.
 The command does not run candidate checks or publish tags.
 
+## Credential preflight
+
+Both `Deliver` and the CLI perform a read-only destination preflight after
+cheap local request and source checks. It happens before managed builds and
+full artifact size and digest verification. If it succeeds, delivery verifies
+the local artifact contents before making any hosted write. A failed preflight
+leaves delivery `not_attempted`, including when the service is unavailable.
+
+Call `PreflightDelivery` directly when another caller-controlled operation
+should follow credential verification. The check needs no checkout or published
+tag and performs no test release or upload. For Gitea it verifies authenticated
+repository access; exposed metadata can identify known deficiencies, but
+successful preflight does not guarantee later release or asset writes. A
+`DeliveryPreflightError` identifies missing credentials, rejected credentials,
+known insufficient permissions, an inaccessible destination, or unavailable
+verification. Its `Unwrap` method preserves the cause for `errors.Is` and
+`errors.As`. A 403 means access was denied, not necessarily that a token
+expired; a 404 can mean a missing repository or hidden access.
+
+```go
+err := releasekit.PreflightDelivery(ctx, releasekit.DeliveryDestination{
+    Forge:      releasekit.ForgeGitea,
+    BaseURL:    "https://gitea.example",
+    Owner:      "example",
+    Repository: "example",
+    Token:      token,
+})
+if err != nil {
+    var preflight *releasekit.DeliveryPreflightError
+    if errors.As(err, &preflight) {
+        log.Printf("delivery preflight %s: %v", preflight.Kind, preflight.Err)
+    }
+    return err
+}
+```
+
+The CLI performs the same check automatically. For binary `ci-deliver`, it
+checks access before application dependency downloads, then `Deliver` checks
+again after preparation. Page-only CI needs no separate preflight call.
+`check`, `build`, and source `publish` remain independent of hosted delivery
+credentials. Calling preflight before source publication is optional and does
+not add a publication gate.
+
 ## Go API
 
-Pass the Gitea credential explicitly. Set `Build` to a `BuildSpec` to compile
-selected targets as part of delivery. The facade verifies the local tag, clean
-checkout, and committed release note before compiling. Managed output is stored
-outside the checkout and removed when delivery returns. `Output` receives build
-progress. With no build, or with an empty target set, delivery is page-only.
+Pass the Gitea credential explicitly and select `ForgeGitea`. Set `Build` to a
+`BuildSpec` to compile selected targets as part of delivery. The facade verifies
+the local tag, clean checkout, and committed release note before compiling.
+Managed output is stored outside the checkout and removed when delivery
+returns. `Output` receives build progress. With no build, or with an empty
+target set, delivery is page-only.
 
 To deliver binaries built separately, set `Prebuilt` to the `BuildResult`.
 ReleaseKit checks its repository, module directory, declared module path, full
@@ -176,7 +225,8 @@ result, err := releasekit.Deliver(ctx, releasekit.DeliveryRequest{
     Product:       "Example",
     Version:       "v1.2.3",
     ExpectedTag:   "integrations/example/v1.2.3", // optional CI event check
-    Destination: releasekit.GiteaDestination{
+    Destination: releasekit.DeliveryDestination{
+        Forge:      releasekit.ForgeGitea,
         BaseURL:    "https://gitea.example",
         Owner:      "example",
         Repository: "example",