docs(arch): tighten tls/endpoint/client specs — remove connect/connect_quic, move CallCredentials to core, shed alknet-call TLS deps

Review of the three new crates (alknet-tls, alknet-endpoint, alknet-client)
+ revised core found compile-blocking inconsistencies, stale claims, and
dep-graph contradictions. All resolved:

Critical:
- C1: CallClient::connect / ChannelClient::connect_quic REMOVED (not
  delegated) — keeping them as thin wrappers over AlknetClient::dial_quic
  would make protocol crates depend on alknet-client, contradicting the
  dep graph. Callers compose dial + take-over (2 lines).
- C2: alknet-client feature gates now pull alknet-core/quinn +
  alknet-core/iroh (for Connection::from_quinn_with_alpn / from_iroh).
- C3: rustls-native-certs + webpki-roots added to alknet-tls deps
  (always-present, not feature-gated — CA-verify path is transport-agnostic).

Warning:
- W1: CallCredentials/RemoteIdentity moved to alknet-core (from
  alknet-call) — the dial must not depend on the call protocol; not a
  two-way-door, it determines the dep graph.
- W2: webpki-roots fallback implemented in spec (ADR-088 §5 added) —
  the code claimed a fallback that never existed; now the store is never
  empty, NoRootAnchors unreachable, containerized deployments work.
- W3: EndpointError removed entirely (BindFailed + HandlerNotFound both
  vestigial after ADR-083); shutdown() is now infallible.
- W4: FingerprintPinVerifier moved to alknet-tls (from alknet-call) —
  alknet-call sheds quinn/rustls/rustls-pemfile/rustls-native-certs
  entirely; CallClient becomes a pure protocol crate.

Plus: ClientError removed (only produced by removed connect); S1
(CallCredentials → ClientVerifierContext mapping + auth_token stripped
at TLS boundary documented); amendment notes on ADR-017, ADR-069,
ADR-080, ADR-082, ADR-087, ADR-090; overview crate graph + README index
updated.

29 files, consistency-reviewed.

docs/architecture/crates/hub/README.md

@@ -287,15 +287,18 @@ another hub (A) is a client from A's perspective. The dial needs a
 client-side TLS config (`TlsClientConfig`, ADR-087) for the outbound
 connection's `rustls::ClientConfig` (verifier selection per ADR-034:
 fingerprint pin for the worker's known key). The dial path mirrors the
-`from_connection` / `connect_quic` split (ADR-080):
+`from_connection` primary (ADR-080; `ChannelClient::connect_quic` is
+removed per ADR-089 §5 — the dial lives in `AlknetClient`):
 
 ```rust
 impl Hub {
     /// Take over a pre-established channels `Connection` as a worker
     /// connection. Transport-agnostic — the caller (or a transport
     /// helper) produces the `Connection`. This is the primary path;
-    /// `connect_quic_worker` and future `connect_tcp_tls_worker` are
-    /// conveniences over it.
+    /// `connect_quic_worker` (a hub-level convenience, distinct from
+    /// the removed `ChannelClient::connect_quic` per-protocol
+    /// constructor — ADR-089 §5) and future `connect_tcp_tls_worker`
+    /// are conveniences over it.
     pub async fn dial_worker_connection(
         &self,
         connection: Connection,
@@ -610,8 +613,8 @@ pub enum HubError {
     NoPeerIdentity,
     #[error("from_call discovery failed: {0}")]
     Discovery(#[from] AdapterError),
-    #[error("call client error: {0}")]
-    Client(#[from] ClientError),
+    #[error("dial error: {0}")]
+    Dial(#[from] alknet_client::ClientDialError),
     #[error("channel error (client or adapter path): {0}")]
     Channel(#[from] ChannelError),
     #[error("registration failed: {0}")]
@@ -654,7 +657,8 @@ alknet-hub (Hub struct deps)
 ├── alknet-channels-call (ChannelClient, ChannelsAdapter, ChannelManager,
 │                         ChannelBidiStreamSource)
 ├── alknet-call (CallAdapter, Dispatcher, PeerCompositeEnv,
-│                from_call, FromCallConfig, AdapterError, ClientError)
+│                from_call, FromCallConfig, AdapterError)
+├── alknet-client (AlknetClient, ClientDialError — for outbound worker dials)
 ├── alknet-http (HttpAdapter — for the registration endpoint and browser access)
 ├── alknet-core (IdentityProvider, Connection, OperationRegistry,
 │                AuthContext)
@@ -787,7 +791,7 @@ into `CallAdapter::with_aggregated_env`.
 | Peer-graph routing model | [ADR-029](../../decisions/029-peer-graph-routing-model.md) | Peer-keyed overlays, `PeerRef` routing, `AccessControl`-based peer auth |
 | PeerEntry and Identity.id | [ADR-030](../../decisions/030-peerentry-and-identity-id-decoupling.md) | `PeerId` = `Identity.id` = `PeerEntry.peer_id` (stable) |
 | Three peer roles | [ADR-034](../../decisions/034-outgoing-only-x509-and-three-peer-roles.md) | Hub = role-3 `PeerEntry` (mixed fingerprints); browsers not peers; bearer-token identity over TCP/WebTransport |
-| ChannelClient — transport-agnostic | [ADR-080](../../decisions/080-channelclient.md) | `from_connection` primary, `connect_quic` convenience; the dial path the hub uses |
+| ChannelClient — transport-agnostic | [ADR-080](../../decisions/080-channelclient.md) | `from_connection` primary; `connect_quic` removed per ADR-089 §5 (dial extracted to `AlknetClient`); the dial path the hub uses |
 | Channels transport-agnostic | [ADR-071](../../decisions/071-channels-wire-format.md) | Substrate modes; `Connection::from_stream`/`from_bidi` (ADR-065) — the substrate the hub relays |
 | TCP+TLS as first-class owned transport | [ADR-083](../../decisions/083-endpoint-as-accept-loop-runner.md) | `with_tcp_tls(listener, acceptor)` — TCP+TLS is owned by the endpoint, not a sibling loop; supersedes ADR-010 Am. 1 |
 | Channel 0 pre-negotiated | [ADR-072](../../decisions/072-channel-0-pre-negotiated-call.md) | Channel 0 = `alknet/call`; the `CallAdapter` runs here |
@@ -832,7 +836,8 @@ See [open-questions.md](../../open-questions.md) for full details.
 ## References
 
 - [channel-client.md](../channels/channel-client.md) — `ChannelClient`
-  (`from_connection` / `connect_quic` — the dial path)
+  (`from_connection` — the take-over; `connect_quic` removed per
+  ADR-089 §5, dial now via `AlknetClient`)
 - [channels-adapter.md](../channels/channels-adapter.md) —
   `ChannelsAdapter`, `ChannelManager`, the accept path
 - [channel-operations.md](../channels/channel-operations.md) —