feat: expose connector datasource origins

docs/CONCEPT.md

@@ -32,6 +32,8 @@ The module owns:
 
 The module does not own:
 
+- governed datasource identity, staging, materializations, frozen states, or
+  consumer read semantics, owned by `govoplan-datasources`
 - file storage semantics, owned by files/DMS
 - identity provisioning semantics, owned by IDM/access
 - mail/calendar semantics, owned by mail/calendar
@@ -69,6 +71,11 @@ Domain modules should ask whether a connector capability exists and request a
 profile/test result through core-mediated capabilities. They must not import
 connector implementation modules directly.
 
+Data-oriented consumers use a two-layer path: Connectors publishes a
+provider-specific datasource origin, then Datasources registers and governs it.
+Dataflow, Workflow, Reporting, and other consumers use Datasources rather than
+calling the connector origin directly.
+
 ## Reference Journeys
 
 ### OpenProject Connector First