docs: composability boundary + public-clone deployment anchor

- vision: 'ALPN as a service' section (core is front-door-blind; v1
  reduces to storage + ACL + protocol adapters); primary deployment
  target = public anonymous fetch, authenticated push, minimal ACL
- alk-stack: concrete composability boundary (core+transport depend on
  alkcall types only; adapters replaceable)
- AGENTS.md: convention 15 codifies the boundary

Verified: none needed (markdown only)

docs/research/alk-stack.md

@@ -72,7 +72,10 @@ Both interfaces converge on the same core: **a `BiStream`-like duplex
 session + repo identity + caller identity** → `alkgit-transport` runs the
 smart protocol and produces/consumes packs via `alkgit-core`. The interfaces
 are thin adapters; all policy (auth, ACL, limits) lives before the transport
-layer gets the stream.
+layer gets the stream. This is the same "ALPN as a service" shape as
+alktty/alktunnels/alksocks: the git member of the family, one core, many
+front doors, and nothing below the transport boundary knows or cares which
+door produced the stream.
 
 ## What to verify before architecture commits (POC candidates)
 
@@ -87,6 +90,19 @@ layer gets the stream.
    as raw duplex streams rather than chunk-framed channels if needed.
 4. **alktls ACME**: config shape for the http endpoint; likely trivial.
 
+## Composability boundary (what "ALPN as a service" implies here)
+
+Same family pattern as alktty/alktunnels/alksocks (alknet decomposition):
+one core that is front-door-blind, adapters that each speak one door. For
+alkgit the boundary is concrete:
+
+- `alkgit-core` + `alkgit-transport` depend on alkcall types only
+  (`BiStream`, identity/ACL types); they never depend on alkhttp or
+  alkgit-ssh, and carry no http/channel-specific types below the stream.
+- The http and ssh crates are replaceable: a downstream app (gitea-like)
+  embeds the core + transport and brings its own front doors.
+- Admin API = alkcall ops, usable as-is or replaced by a downstream app.
+
 ## Version pins in workspace manifests
 
 - `alkcall 0.8` (published), `alkhttp 0.5` (published), `alktls 0.1`