examples/README: correct source-format note to reflect console exports

The note claimed every example is generated by bin/convert_catalog_to_yaml.py, which is no longer true — several examples are now direct Falcon console exports (the definitive import/export format). Documents both sources, marks console export as preferred/definitive, and keeps the deterministic converter as the fallback for catalog records. No example is hand-translated.

Author: mraible

skills/authoring/examples/README.md

@@ -75,26 +75,29 @@ values are preserved exactly as they appear in the source playbooks.
 
 ## A note on the source format
 
-These workflows were sourced from CrowdStrike Content Library catalog records (JSON)
-and converted to YAML for developer readability. Node labels and condition names are
-derived from the original graph, so `${data['...']}` references between actions stay
-consistent.
-
-The YAML here matches the Falcon console's own **import/export** format (a flat
-`trigger` + `actions` map with `next` edges), which is a strict superset of what the
-catalog record carried — YAML loses nothing the platform needs. Every example is
-verified against the live import API (`import_definition` with `validate_only`).
-
-**Authoring guardrail — always ground new examples in a real export.** The catalog
-record is not the import format, and hand-conversion is lossy: an early version of
-these examples dropped the Signal trigger's required `event:` field and invented a
-trigger `id`, which broke import. To add or fix an example, either export a working
-workflow from the console (or `export_definition`) and adapt that real YAML, or run
-the deterministic converter `bin/convert_catalog_to_yaml.py` on a catalog record —
-do not hand-translate. The converter resolves the Signal `event:` from the trigger
-catalog automatically. A Signal trigger must carry `event:` (the trigger category,
-e.g. `Investigatable/NGSIEM`); discover values with `trigger_search.py --events`.
-
-Every example here is generated by `bin/convert_catalog_to_yaml.py` and verified to
-import cleanly (`import_definition` with `validate_only`), so regenerating them is
-reproducible rather than a manual re-typing pass.
+These workflows are real Falcon Fusion playbooks from the CrowdStrike Content
+Library, in the Falcon console's own **import/export** format: a flat `trigger`
+plus an `actions` map with `next` edges, `conditions`, and `loops`. Every example
+is verified against the live import API (`import_definition` with `validate_only`).
+
+Examples come from one of two sources, noted in each file's header:
+
+- **Console export (preferred, definitive).** Installed from the Content Library
+  and exported unmodified from the console. This is ground truth — it round-trips
+  through Fusion's own serializer, so it imports cleanly by construction. Newer
+  examples (e.g. the VirusTotal, AbuseIPDB, phishing-ITP, and LLM-enrichment
+  playbooks) use this path.
+- **Deterministic conversion.** Some examples were produced by running
+  `bin/convert_catalog_to_yaml.py` on a Content Library catalog record (JSON).
+  The converter resolves the Signal `event:` from the trigger catalog
+  automatically. Prefer a console export when one is available; the catalog record
+  is not the import format and conversion is a best-effort reproduction of it.
+
+**Authoring guardrail — always ground new examples in a real workflow.** Never
+hand-translate a catalog record: an early version of these examples dropped the
+Signal trigger's required `event:` field and invented a trigger `id`, which broke
+import. To add or fix an example, either export a working workflow from the console
+(`export_definition`) — the preferred path — or run
+`bin/convert_catalog_to_yaml.py` on a catalog record. A Signal trigger must carry
+`event:` (the trigger category, e.g. `Investigatable/NGSIEM`); discover values with
+`trigger_search.py --events`.