docs(arch): tighten tls/endpoint/client specs — remove connect/connect_quic, move CallCredentials to core, shed alknet-call TLS deps

Review of the three new crates (alknet-tls, alknet-endpoint, alknet-client)
+ revised core found compile-blocking inconsistencies, stale claims, and
dep-graph contradictions. All resolved:

Critical:
- C1: CallClient::connect / ChannelClient::connect_quic REMOVED (not
  delegated) — keeping them as thin wrappers over AlknetClient::dial_quic
  would make protocol crates depend on alknet-client, contradicting the
  dep graph. Callers compose dial + take-over (2 lines).
- C2: alknet-client feature gates now pull alknet-core/quinn +
  alknet-core/iroh (for Connection::from_quinn_with_alpn / from_iroh).
- C3: rustls-native-certs + webpki-roots added to alknet-tls deps
  (always-present, not feature-gated — CA-verify path is transport-agnostic).

Warning:
- W1: CallCredentials/RemoteIdentity moved to alknet-core (from
  alknet-call) — the dial must not depend on the call protocol; not a
  two-way-door, it determines the dep graph.
- W2: webpki-roots fallback implemented in spec (ADR-088 §5 added) —
  the code claimed a fallback that never existed; now the store is never
  empty, NoRootAnchors unreachable, containerized deployments work.
- W3: EndpointError removed entirely (BindFailed + HandlerNotFound both
  vestigial after ADR-083); shutdown() is now infallible.
- W4: FingerprintPinVerifier moved to alknet-tls (from alknet-call) —
  alknet-call sheds quinn/rustls/rustls-pemfile/rustls-native-certs
  entirely; CallClient becomes a pure protocol crate.

Plus: ClientError removed (only produced by removed connect); S1
(CallCredentials → ClientVerifierContext mapping + auth_token stripped
at TLS boundary documented); amendment notes on ADR-017, ADR-069,
ADR-080, ADR-082, ADR-087, ADR-090; overview crate graph + README index
updated.

29 files, consistency-reviewed.

docs/architecture/crates/core/README.md

@@ -8,13 +8,17 @@ last_updated: 2026-07-15
 Shared types, auth, config, and identity for ALPN-based protocol
 dispatch. Every handler crate depends on `alknet-core` for
 `ProtocolHandler`, `Connection`, `AuthContext`, `IdentityProvider`, and
-config types. The endpoint (`AlknetEndpoint`, `HandlerRegistry`,
-`EndpointError`) has been extracted to
-[`alknet-endpoint`](../endpoint/README.md) (ADR-083 Amendment
-2026-07-15); core no longer carries the accept-loop runner or its
-transport deps (quinn, iroh, rcgen, rustls-acme). `Connection::from_quinn`
-/ `from_iroh` stay in core's `types.rs` as shared constructors (gated
-on core's `quinn` / `iroh` features).
+config types. The endpoint (`AlknetEndpoint`, `HandlerRegistry`) has
+been extracted to [`alknet-endpoint`](../endpoint/README.md) (ADR-083
+Amendment 2026-07-15; `EndpointError` is removed — both variants were
+vestigial); core no longer carries the accept-loop runner or its
+transport deps (quinn, iroh, rcgen, rustls-acme).
+`Connection::from_quinn` / `from_iroh` stay in core's `types.rs` as
+shared constructors (gated on core's `quinn` / `iroh` features).
+`CallCredentials` and `RemoteIdentity` move to `alknet-core` (from
+`alknet-call`, per ADR-089 §5) — both the call and channels clients
+need them, and the dial (`alknet-client`) must not depend on the call
+protocol for the credential type.
 
 ## Documents
 

docs/architecture/crates/core/core-types.md

@@ -67,8 +67,8 @@ impl Connection {
     pub fn from_quinn(conn: quinn::Connection) -> Self;
 
     /// Construct from a quinn connection with an explicit ALPN (feature-gated
-    /// on quinn). Used by the client path (`CallClient::connect`) and the
-    /// endpoint's quinn accept loop.
+    /// on quinn). Used by the client path (`AlknetClient::dial_quic` per
+    /// ADR-089) and the endpoint's quinn accept loop.
     #[cfg(feature = "quinn")]
     pub fn from_quinn_with_alpn(conn: quinn::Connection, alpn: Vec<u8>) -> Self;
 

docs/architecture/crates/core/endpoint.md

@@ -5,10 +5,11 @@ last_updated: 2026-07-15
 
 # Endpoint (moved to `alknet-endpoint`)
 
-> **This document is deprecated.** The `AlknetEndpoint`,
-> `HandlerRegistry`, and `EndpointError` types have been extracted from
-> `alknet-core` into a new crate `alknet-endpoint` (ADR-083 Amendment
-> 2026-07-15). The canonical spec is now
+> **This document is deprecated.** The `AlknetEndpoint` and
+> `HandlerRegistry` types have been extracted from `alknet-core` into a
+> new crate `alknet-endpoint` (ADR-083 Amendment 2026-07-15).
+> `EndpointError` is removed (both variants were vestigial). The
+> canonical spec is now
 > [`crates/endpoint/README.md`](../endpoint/README.md).
 >
 > The shared types the endpoint imports (`ProtocolHandler`,