docs(tasks): post-remediation sweep — 4 follow-up tasks

Found in the sweep of completed review-001 remediation:
- /publish schema validation fails open on compile error + recompiles
  per request (remediation-introduced, routes.rs:254-268)
- OAI-06 loud-degradation unblocked and still open (HTTP_0 marker)
- HY-06 ExponentialBackoff in public API + COV-02 mTLS success path
  both unblocked post client-config rework
- HY-02/04/11 publish-prep docs gate (104 missing-docs warnings
  re-measured)

Also flagged, not tasked here: WS-12 (alkcall demux 4 GiB discard
alloc) was never actually filed in alkcall's consumer-findings-ledger —
only CF-001 is there. File it when next touching alkcall.

taskgraph: validate clean (42), no cycles

tasks/client/review-001-client-config-and-cert-coverage.md

@@ -0,0 +1,55 @@
+---
+id: review-001-client-config-and-cert-coverage
+name: Client config API cleanup (HY-06) + mTLS/CA-bundle test coverage (COV-02)
+status: pending
+depends_on: []
+scope: narrow
+risk: low
+impact: component
+level: implementation
+tags: [client, review-001, follow-up, coverage]
+---
+
+## Description
+
+Two deferred client-host items, grouped (same file, `src/client/http_client.rs`):
+
+- **HY-06**: `HttpClientConfig.retry_policy` exposes
+  `reqwest_retry::ExponentialBackoff` in the public API (`:116`) — a
+  semver anchor to an upstream concrete type and an awkward construction
+  surface. The post-remediation config (RetryGate, TotalRetryBudget,
+  attempt counts, backoff bounds, budget deadline) is exactly why this
+  should now be an owned config struct (e.g. `max_retries`,
+  `max_retry_interval`, `initial_backoff`, `max_total_retry_duration`)
+  from which the middleware stack builds the internal backoff. Breaks
+  the public type — fine pre-publish; do it once, now, while the
+  surface is small.
+- **COV-02 residue**: no test constructs a client with a working CA
+  bundle or client cert — only the missing-file error paths are tested
+  (`new_with_missing_ca_bundle_errors`). Post-remediation the
+  redirect/retry gates hang off this client, so the TLS-config paths
+  should be exercised: a test server with a self-signed cert + client
+  presenting its own cert, happy path through the full middleware stack.
+
+## Acceptance Criteria
+
+- [ ] `HttpClientConfig` no longer exposes `ExponentialBackoff`; owned field set covers what the remediation made configurable; module docs updated
+- [ ] Existing config-construction call sites migrated (adapters' test fixtures included)
+- [ ] TLS test: client built with a CA bundle connects to a private-roots server; client-cert path exercised end-to-end (COV-02's uncovered build paths)
+- [ ] Feature matrix green (default, `--all-features`, `--no-default-features`)
+- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
+
+## References
+
+- docs/reviews/001-initial-implementation-review.md (Part H, HY-06; Part I, COV-02)
+- tasks/client/review-001-client-timeout-retry.md (the retry policy work this builds on)
+
+## Notes
+
+> Agent fills during implementation. Public-API shape change —
+> coordinate with review-001-missing-docs-sweep if running concurrently
+> (same module's docs).
+
+## Summary
+
+> Filled on completion.