docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

tasks/infra/review-001-dependency-hygiene.md

@@ -0,0 +1,61 @@
+---
+id: review-001-dependency-hygiene
+name: Dependency and feature hygiene (HY-01, HY-05, HY-08, HY-12, CON-10)
+status: pending
+depends_on: []
+scope: narrow
+risk: trivial
+impact: project
+level: implementation
+tags: [infra, review-001, cargo]
+---
+
+## Description
+
+Review 001 hygiene findings that are pure Cargo.toml / dependency work —
+mechanical, parallelizable, worth landing any time:
+
+- **HY-01 [major]**: `openapiv3` is a production dependency used only
+  inside `#[cfg(test)]` (`to_openapi.rs:1103`). Move to
+  `[dev-dependencies]`.
+- **HY-05**: `bytes` declared, zero direct use in src/ (only axum's
+  re-export); `parking_lot` declared, zero direct use; `tokio` features =
+  `["full"]` drags in `process`/`signal` extras. Prune to what's used.
+- **HY-08**: `tokio-tungstenite` declared three times with different
+  feature sets (`wss`, `test-support`, dev-deps); make `test-support`
+  extend `wss` (also resolves CON-10's class of fragility) — note
+  `required-features` fix itself is tracked in
+  review-001-consumer-adapter-hygiene (CON-10).
+- **HY-12**: duplicate dependency roots (`getrandom 0.3/0.4`,
+  `cpufeatures 0.2/0.3`) driven by `tokio-tungstenite 0.28` here vs
+  `tungstenite 0.29` via axum's ws — align versions to collapse.
+- Related slack: HY-07 (`READ_SLOTS` pub constant leak in a public
+  module — privatize or document) can ride along.
+
+Deliberately deferred to a later pass: HY-02 (the 110-warning
+`missing_docs` sweep — better done once the remediation stabilizes the
+API), HY-04 (test-support `unwrap`, documented as intentional), HY-06
+(`ExponentialBackoff` in public API — revisit when the client config
+settles), HY-10 (stale docs — several overlap fixes landing in other
+tasks), HY-11 (`docs/` in the package — needs a publishing decision).
+
+## Acceptance Criteria
+
+- [ ] `openapiv3` in dev-dependencies only
+- [ ] `cargo tree -d` duplicate roots reduced (getrandom/cpufeatures collapse)
+- [ ] Unused deps pruned; tokio features tightened (build passes in default, `mcp`-only, `wss`, `--all-features`, `--no-default-features`)
+- [ ] HY-07 resolved (privatized or documented)
+- [ ] Full feature matrix still green: default, `--all-features`, `mcp`-only, `wss`-only, `--no-default-features`
+
+## References
+
+- docs/reviews/001-initial-implementation-review.md (Part H, HY-01, HY-05, HY-07, HY-08, HY-12)
+
+## Notes
+
+> Agent fills during implementation. Safe to land any time; keep it
+> separate from behavioral tasks so reverts are clean.
+
+## Summary
+
+> Filled on completion.