docs(arch): clean unwrap, remove stale ownership, protocol-agnostic hub core

- Replace .unwrap() with .expect() in spec pseudocode; remove .unwrap()
  from ADR-067 prose. Specs describe intent, not implementation details.

- Remove 'ownership reaping' from hub's 'does NOT do' list. Ownership
  is an alknet-docker concern, not a hub concern. The other agent's
  hedging leaked into the spec; removed.

- Restructure hub README: separate core peer lifecycle (protocol-agnostic)
  from call-protocol strategy (first strategy). Add extension points
  section for future tty/blobs/custom strategies. A QUIC connection can
  multiplex multiple protocols over separate streams; the hub's core
  manages the connection, each strategy manages its own protocol-specific
  state. The call-protocol strategy handles the majority of real-world
  use cases; the architecture keeps the door open for others.

docs/architecture/decisions/067-aggregated-peer-env-wiring.md

@@ -104,8 +104,13 @@ pub fn compose_root_env(
         .and_then(|s| s.overlay_for(context));
 
     if let Some(aggregated) = &self.aggregated_env {
-        // Clone the shared aggregated env (cheap — all fields are Arc).
-        let mut env = aggregated.read().unwrap().clone();
+        // Acquire read lock on the shared aggregated env, clone it (cheap —
+        // all fields are Arc), and release the lock. The clone is the
+        // per-call snapshot; the lock is not held for the call duration.
+        let mut env = aggregated
+            .read()
+            .expect("aggregated env lock poisoned")
+            .clone();
         // Attach the current connection's overlay as an override for this
         // call only. The current connection's overlay is the authoritative
         // view of *that* peer; the aggregated env is the authoritative view
@@ -146,10 +151,10 @@ let adapter = CallAdapter::new(registry, identity_provider)
     .with_aggregated_env(Arc::clone(&aggregated));
 ```
 
-The hub calls `aggregated.write().unwrap().attach_peer(peer_id, overlay)` on
-every worker connection-establish (after `from_call` populates the overlay)
-and `detach_peer(&peer_id)` on every disconnect. The `RwLock` write is held
-only for the `HashMap` insert/remove — connection-rate, not call-rate.
+The hub calls `attach_peer(peer_id, overlay)` on the aggregated env on every
+worker connection-establish (after `from_call` populates the overlay) and
+`detach_peer(&peer_id)` on every disconnect. The write lock is held only for
+the `HashMap` insert/remove — connection-rate, not call-rate.
 
 ### 5. `PeerCompositeEnv` gains `Clone`