Land src/core/package: the pure RSBK container — format ladder, JSON manifest, framing/layout codec

Two-integer ladder (formatVersion/minReaderVersion), bare-name-only entries
validated on encode and decode, prefix decode that proves exact file size
without ever reading a payload.

src/core/package/package_format.cpp

@@ -0,0 +1,23 @@
+#include "core/package/package_format.h"
+
+namespace reasampler::package {
+
+PackageReadability classifyPackageVersion(std::uint32_t formatVersion,
+                                          std::uint32_t minReaderVersion) {
+    if (formatVersion == 0 || minReaderVersion == 0) return PackageReadability::Malformed;
+    if (minReaderVersion > formatVersion) return PackageReadability::Malformed;
+    if (minReaderVersion > kPackageFormatVersion) return PackageReadability::TooNew;
+    return PackageReadability::Readable;
+}
+
+bool isValidEntryName(const std::string& name) {
+    if (name.empty() || name.size() > kMaxEntryNameBytes) return false;
+    if (name == ".") return false;
+    if (name.find("..") != std::string::npos) return false;
+    for (char c : name) {
+        if (c == '/' || c == '\\' || c == ':') return false;
+    }
+    return true;
+}
+
+}  // namespace reasampler::package