Add safe Vcore wowdiag and wowsrc imports with original-data provenance

docs/package-format-v1.md

@@ -126,6 +126,12 @@ validation itself streams. No artifact interpretation is performed.
 
 ## Writer API and publication contract
 
+`PackageFactory.create(destination, manifest, artifacts)` creates a generation-zero
+package from caller-supplied metadata and byte artifacts. It adds integrity records,
+applies PackageLimits, validates the staged ZIP, flushes/fsyncs and publishes
+atomically without replacing an existing target. It is project-independent;
+subsequent enrichment still uses PackageWriter.
+
 ```python
 from viano_bug_analysis.package import PackageWriter, PackageWriteError