feat: workspace skeleton + phase 0 research docs

- Cargo workspace with 5 sub-crates: alkgit-core (storage),
  alkgit-transport (smart protocol), alkgit-http, alkgit-ssh, alkgitd
  (binary); sha1 pinned through the gix stack, sha256 passthrough feature
- docs/research/: vision, gitoxide alignment, alk stack fit, server-side
  protocol inventory, license/reference policy, POC plan
- AGENTS.md: conventions mirroring alkcall (no comments, thiserror, tokio,
  no secrets on wire/at rest, visible-surface=authorized-surface,
  gitoxide-only serving path, bounded resources, registry-resolved repos)

Verified: cargo build, clippy -D warnings, fmt, test, check --all-features

crates/alkgit-core/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "alkgit-core"
+description = "Core git plumbing for alkgit: repository storage, ref management, pack handling, and access rules — transport-agnostic"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+gix = { workspace = true }
+gix-odb = { workspace = true }
+gix-pack = { workspace = true }
+gix-ref = { workspace = true }
+gix-object = { workspace = true }
+gix-hash = { workspace = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+
+[features]
+default = []
+sha256 = ["gix/sha256"]

crates/alkgit-core/src/lib.rs

@@ -0,0 +1 @@
+#![forbid(unsafe_code)]

crates/alkgit-http/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "alkgit-http"
+description = "HTTP interface for alkgit: git smart-http (info/refs, git-upload-pack, git-receive-pack) and the admin API over alkhttp"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+alkgit-core = { workspace = true }
+alkgit-transport = { workspace = true }
+alkhttp = { workspace = true }
+alkcall = { workspace = true }
+bytes = { workspace = true }
+tokio = { workspace = true }
+futures = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+
+[features]
+default = []
+sha256 = ["alkgit-transport/sha256"]

crates/alkgit-http/src/lib.rs

@@ -0,0 +1 @@
+#![forbid(unsafe_code)]

crates/alkgit-ssh/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "alkgit-ssh"
+description = "SSH interface for alkgit: git-over-ssh command serving (git-upload-pack / git-receive-pack) on alkcall channels"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+alkgit-core = { workspace = true }
+alkgit-transport = { workspace = true }
+alkcall = { workspace = true }
+tokio = { workspace = true }
+futures = { workspace = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+
+[features]
+default = []
+sha256 = ["alkgit-transport/sha256"]

crates/alkgit-ssh/src/lib.rs

@@ -0,0 +1 @@
+#![forbid(unsafe_code)]

crates/alkgit-transport/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "alkgit-transport"
+description = "Git smart-protocol transport for alkgit: packetline framing, capability advertisement, upload-pack and receive-pack serving over alkcall BiStreams"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+alkgit-core = { workspace = true }
+alkcall = { workspace = true }
+gix-packetline = { workspace = true }
+gix-protocol = { workspace = true }
+gix-transport = { workspace = true }
+gix-hash = { workspace = true }
+bytes = { workspace = true }
+tokio = { workspace = true }
+futures = { workspace = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+
+[features]
+default = []
+sha256 = ["alkgit-core/sha256"]

crates/alkgit-transport/src/lib.rs

@@ -0,0 +1 @@
+#![forbid(unsafe_code)]

crates/alkgitd/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "alkgitd"
+description = "The alkgit server binary: assembles storage, smart protocol, HTTP, SSH, and TLS into one self-hosted git server"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[[bin]]
+name = "alkgitd"
+path = "src/main.rs"
+
+[dependencies]
+alkgit-core = { workspace = true }
+alkgit-transport = { workspace = true }
+alkgit-http = { workspace = true }
+alkgit-ssh = { workspace = true }
+alkhttp = { workspace = true }
+alktls = { workspace = true }
+alkvault = { workspace = true }
+tokio = { workspace = true }
+serde = { workspace = true }
+tracing = { workspace = true }
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+thiserror = { workspace = true }
+
+[features]
+default = []
+sha256 = ["alkgit-http/sha256"]
+acme = ["alktls/acme"]

crates/alkgitd/src/main.rs

@@ -0,0 +1,3 @@
+fn main() {
+    println!("alkgitd: skeleton — server assembly lands after architecture (SDD phase 1)");
+}