Add configuration path explanations

docs/cli.md

@@ -173,6 +173,53 @@ including empty fields, zero coordinates, and synthetic sources without paths.
 An empty inventory is `sources: []`. Text output begins with the scope heading
 and then prints the same source fields, quoting labels and paths.
 
+### Explain a configuration path
+
+`config explain --path POINTER` explains the effective and historical value at a
+JSON Pointer path. `--path` is required; an explicitly empty value selects the
+root. The default scope is `app`; `--format yaml` selects structured output, and
+text is the default. `--scope all` is unsupported.
+
+```text
+example config explain --path /server/addr
+example config explain --path /profiles/team~1summary --format yaml
+example config explain --path= --format yaml
+```
+
+Pointer tokens use JSON Pointer escaping: `~1` represents `/` and `~0`
+represents `~`. A malformed pointer is a usage error with status `2` and is
+rejected before acquisition. A well-formed path that is unknown in the selected
+configuration is an operational error with status `1`. Text output comes from
+the scope's native explanation writer.
+
+YAML output uses these root fields:
+
+```yaml
+scope: app
+path: /server/addr
+effective:
+  present: true
+  redacted: false
+  yaml: "localhost:8080\n"
+origin:
+  layer: base
+  locations:
+    - source_id: source-1
+      line: 4
+      column: 9
+  operation: ""
+  inheritance: []
+history: []
+secret_reference: null
+```
+
+Snapshot `yaml` values remain strings, including null and empty fragments.
+Origin and history retain source locations, operation names, inheritance paths,
+ordered reasons and dependencies. Secret references contain only the owning
+environment-variable name; effective and historical secret fragments remain
+redacted. Empty location, inheritance, history, reason, and dependency lists are
+serialized as `[]`.
+
 ## Outcome status
 
 CommandKit usage failures use status `2`; operational failures use status `1`.