refactor(architecture): ADR-010 — pure protocol crate (alktty template)

Structural decision (OQ-09 resolved): alkgit follows the alktty/
alktunnels template — a single published protocol crate on alkcall
channels, no binary, no front doors.

- ADR-010 supersedes ADR-001 (crate decomposition) and ADR-006
  (http router factory); both marked Superseded
- Single crate at repo root: Cargo.toml with gix feature (default-on
  backend implementations; wire layer compiles without it —
  gix-hash always-on with sha1 per the compile-time-rejected
  invariant), crates/ workspace deleted, src/lib.rs stub in place
- doors.md replaces http.md/ssh.md/alkgitd.md: alkhttp git-feature
  sequencing (after first publish), alkssh requirement (fixed-grammar
  exec dispatch), native alk/git path, downstream assembly
- backend.md replaces storage.md: GitRegistry/GitRefs/GitPackGen/
  GitPackIngest traits (ingest validates, refs commits — single CAS
  home), gix feature encodes POC-2 prerequisites
- transport.md reframed for the single crate; backend traits replace
  hook traits in the public API
- OQ-09 resolved (all five sub-decisions in ADR-010), OQ-01 resolved
  (subsumed), OQ-03 narrowed to publish-freeze, OQ-08 narrowed to
  registry identity + vault placement, OQ-07 rescoped to the gix
  feature's registry impl
- vision.md v2: single-binary/monorepo framing corrected as
  init-agent artifact; POC checklist marked complete
- AGENTS.md + .opencode agent specs updated to the new shape

Verification: cargo build (default + no-default-features), cargo test
--all-features, clippy --all-features -D warnings, fmt --check all
pass. Third review round: zero critical, all warnings/suggestions
addressed (GitPackGen signature amended in ADR-004, stale anchors
fixed, ADR-006 body tense normalized, CAS split stated, vision
residuals cleaned).

Cargo.toml

@@ -1,46 +1,58 @@
-[workspace]
-resolver = "2"
-members = [
-    "crates/alkgit-core",
-    "crates/alkgit-transport",
-    "crates/alkgit-http",
-    "crates/alkgit-ssh",
-    "crates/alkgitd",
-]
-
-[workspace.package]
+[package]
+name = "alkgit"
 version = "0.0.1"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"
 repository = "https://git.alk.dev/alkdev/alkgit"
+description = "Git smart protocol for the alk family: pkt-line substrates, protocol V2 serving (upload-pack/receive-pack), producer/consumer halves on alkcall channels, and backend traits with a feature-gated gitoxide implementation"
+keywords = ["git", "protocol", "alkcall", "vcs", "network"]
+categories = ["network-programming", "asynchronous"]
 
-[workspace.dependencies]
-alkgit-core = { path = "crates/alkgit-core", version = "0.0.1" }
-alkgit-transport = { path = "crates/alkgit-transport", version = "0.0.1" }
-alkgit-http = { path = "crates/alkgit-http", version = "0.0.1" }
-alkgit-ssh = { path = "crates/alkgit-ssh", version = "0.0.1" }
+[lib]
+name = "alkgit"
+path = "src/lib.rs"
+
+[features]
+default = ["gix"]
+# gitoxide-backed backend implementations (registry, refs, pack gen/ingest).
+# Disable for a wire/protocol-only embed with your own backends.
+gix = [
+    "dep:gix",
+    "dep:gix-odb",
+    "dep:gix-pack",
+    "dep:gix-ref",
+    "dep:gix-object",
+    "dep:gix-fsck",
+]
+# sha256 passthrough (untested end-to-end; sha1 is pinned by default — OQ-05).
+# gix-hash stays always-on with sha1: the wire layer needs it, and gix-hash
+# fails to compile with neither hash feature selected (compile-time-rejected
+# invariant, see docs/research/gitoxide.md).
+sha256 = ["gix-hash/sha256"]
+
+[dependencies]
 alkcall = "0.8"
-alkhttp = "0.5"
-alktls = "0.1"
-alkvault = "0.1"
-gix = { version = "0.87", default-features = false, features = ["sha1"] }
+gix = { version = "0.87", optional = true, default-features = false, features = ["sha1"] }
+gix-odb = { version = "0.84", optional = true, default-features = false, features = ["sha1"] }
+gix-pack = { version = "0.74", optional = true, features = ["sha1"] }
+gix-ref = { version = "0.67", optional = true }
+gix-object = { version = "0.64", optional = true, features = ["sha1"] }
+gix-fsck = { version = "0.25", optional = true, features = ["sha1"] }
+gix-hash = { version = "0.26", features = ["sha1"] }
 gix-packetline = "0.22"
 gix-protocol = "0.65"
 gix-transport = "0.59"
-gix-pack = { version = "0.74", features = ["sha1"] }
-gix-odb = { version = "0.84", default-features = false, features = ["sha1"] }
-gix-ref = "0.67"
-gix-object = { version = "0.64", features = ["sha1"] }
-gix-hash = { version = "0.26", features = ["sha1"] }
-tokio = { version = "1", features = ["rt-multi-thread", "io-util", "net", "fs", "time", "sync", "macros"] }
+tokio = { version = "1", default-features = false, features = ["rt", "sync", "io-util", "macros", "time"] }
+tokio-util = { version = "0.7", features = ["compat"] }
 futures = "0.3"
 bytes = "1"
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
 thiserror = "2"
 tracing = "0.1"
 parking_lot = "0.12"
 
+[dev-dependencies]
+tokio = { version = "1", features = ["full", "test-util", "macros"] }
+
 [profile.release]
 lto = "thin"