Add public bundle manifest package

docs/operations.md

@@ -76,6 +76,28 @@ Each published destination bundle contains `.distributor.json`. This file is the
 
 Do not edit `.distributor.json` by hand during normal operation. If it is missing or invalid while destination files remain, `distributor` treats the destination as unmanaged or conflicted.
 
+## Go Producer Manifests
+
+Go producer applications can import `gitea.maximumdirect.net/eric/distributor/pkg/bundle` to create source manifests with the same path, digest, timestamp, and validation rules used by `distributor`.
+
+Minimal producer-side manifest creation:
+
+```go
+manifest, err := bundle.BuildManifest(bundle.BuildOptions{
+    Root:  outputDir,
+    ID:    "reports.example.2026-05-30",
+    Files: []string{"report.md", "summary.txt"},
+})
+if err != nil {
+    return err
+}
+if err := bundle.WriteManifest(outputDir, manifest, bundle.WriteManifestOptions{}); err != nil {
+    return err
+}
+```
+
+Use explicit `Files` to preserve caller order, or `Scan: true` to recursively include regular files under `Root` in deterministic slash-path order. Scan mode includes dotfiles, excludes files named `manifest.json` or `.distributor.json`, and rejects symlinks.
+
 ## Dry Runs
 
 `--dry-run` loads and validates config, discovers source bundles, inspects destination state, plans outputs, and prints summary lines. It does not write output files, destination state, or SSH `known_hosts` entries.