ww imports: require imports before declarations

docs/spec.md

@@ -257,6 +257,17 @@ ImportPath    = ident { "." ident } .
   use the related `p_test`, and the actions remain separate even though one
   canonical directory owns their test product. The declared name need not equal
   the directory name or the final component of its canonical import identity.
+- Each source file has one contiguous import section immediately after its
+  package clause. Once a non-import top-level declaration begins, a later
+  `import` is rejected as `imports must appear before other declarations`.
+  Parsing continues for recovery: consecutive imports in that late section
+  produce one ordering diagnostic, while another ordinary declaration followed
+  by another import starts a separately diagnosed late section. Existing
+  aggregate module/reset boundaries and constituent package clauses reset this
+  parser state per source; they do not relax the rule within a source or become
+  package/import identity.
+  A filename excluded by the target-selection rule below reaches no parser and
+  therefore cannot contribute an ordering diagnostic or import edge.
 - Directory source eligibility uses Go 1.26.5 filename suffix semantics for
   WW's fixed `linux/amd64` target. In the basename stem before the first dot, a
   final `_test` token is ignored for platform matching. A final known OS or