feat: workspace skeleton + phase 0 research docs

- Cargo workspace with 5 sub-crates: alkgit-core (storage),
  alkgit-transport (smart protocol), alkgit-http, alkgit-ssh, alkgitd
  (binary); sha1 pinned through the gix stack, sha256 passthrough feature
- docs/research/: vision, gitoxide alignment, alk stack fit, server-side
  protocol inventory, license/reference policy, POC plan
- AGENTS.md: conventions mirroring alkcall (no comments, thiserror, tokio,
  no secrets on wire/at rest, visible-surface=authorized-surface,
  gitoxide-only serving path, bounded resources, registry-resolved repos)

Verified: cargo build, clippy -D warnings, fmt, test, check --all-features

crates/alkgit-core/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "alkgit-core"
+description = "Core git plumbing for alkgit: repository storage, ref management, pack handling, and access rules — transport-agnostic"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+gix = { workspace = true }
+gix-odb = { workspace = true }
+gix-pack = { workspace = true }
+gix-ref = { workspace = true }
+gix-object = { workspace = true }
+gix-hash = { workspace = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+
+[features]
+default = []
+sha256 = ["gix/sha256"]

crates/alkgit-core/src/lib.rs

@@ -0,0 +1 @@
+#![forbid(unsafe_code)]