docs: the targeted fork — ADR-013, the RFC 1928 core is owned

ADR-013 supersedes ADR-011's maintenance posture (not its mechanics):
the extracted T-generic subset is fully owned code, the vendor
framing is retired. Module renamed src/vendor/ -> src/rfc1928/
(naming decided in the ADR: 'vendor' names an ownership relation
now gone; 'socks5' would stutter and collide with the future
producer/consumer layers). Fork point = the tree as of the
extraction-review commit (5b18d4d); provenance stays permanent
(module docs + the extended LICENSE notice).

- ADR-013: fork posture, license mechanics (notice extended, not
  replaced; post-fork modifications under the crate license),
  hand-port replaces re-vendor, lint-allow posture dissolved
- ADR-011 marked Superseded (extraction mechanics remain
  authoritative); ADR-002 references re-pointed
- vendor.md -> rfc1928.md rewritten as the owned-core spec (the cut
  table re-read as the hand-port map)
- spec sweep: README index (ADR-013 row, doc table, principle 8),
  overview (module map, deps, ADR table), producer/consumer/wire/
  bast reference vocabulary, open-questions OQ-SK-04 resolution,
  AGENTS.md conventions 4/17 + verification note + context bullet,
  Cargo.toml description

Verification: cargo doc --no-deps clean; no stale vendor.md/src-vendor
references outside the ADR-011 historical text.

docs/architecture/consumer.md

@@ -29,7 +29,7 @@ Opens `channels/socks5/sub` via `ChannelClient::open_channel`
 (alkcall ADR-037/043), then drives the client side of the RFC
 conversation in-stream over the channel's `BiStream`:
 
-- the vendored client typestate's `use_stream` path — generic over
+- the forked client typestate's `use_stream` path — generic over
   the backing stream (POC #1: `Socks5Stream` impls
   `AsyncRead + AsyncWrite` itself, so the session over a `BiStream`
   is the intended use, not a hack);
@@ -46,7 +46,7 @@ The UDP ASSOCIATE client (POC #2's shape):
   **receives the sentinel `BND.ADDR` and never uses it for
   addressing** (the handle is the channel; ADR-003);
 - `send_datagram(dst, bytes)` frames once
-  (`[len: u16 BE][addr + data]`, the vendored address encoding) and
+  (`[len: u16 BE][addr + data]`, the RFC 1928 address encoding) and
   writes the frame;
 - `recv_datagram()` returns `Some((source_addr, bytes))` per
   datagram — its incremental reader state (mid-frame position +
@@ -63,16 +63,16 @@ The UDP ASSOCIATE client (POC #2's shape):
 
 ### The BIND client
 
-The BIND reply#2 reader (POC #5's `read_reply2` sketch): the vendored
+The BIND reply#2 reader (POC #5's `read_reply2` sketch): the forked
 client `request()` reads reply#1; reply#2 is hand-read with the
-vendored public `read_address` codec (reply#1's codec applied again;
+forked public `read_address` codec (reply#1's codec applied again;
 no second codec). The session then rides the pass-through data
 plane. The BIND client is a wrapper-aware-consumer convenience —
 vanilla clients reach BIND through the front door instead.
 
 ### Error surface
 
-`SocksServerError` / `SocksError` (the vendored surface) mapped
+`SocksServerError` / `SocksError` (the forked surface) mapped
 faithfully; channel-open failures are the typed
 `channel:open_failed` reasons (alkcall ADR-049). A refused session
 never yields a phantom channel; a refused target is an RFC reply
@@ -110,7 +110,7 @@ BIND door):
   channel identity/endpoint selection). The SOCKS password never
   crosses the channel as a SOCKS password; the channel identity
   never reaches the vanilla client. The door checks credentials
-  itself (no vendored `AuthMethod` impl needed — the door owns the
+   itself (no forked `AuthMethod` impl needed — the door owns the
   accept loop).
 
 Door variant selection (NoAuth vs cred-bearing; the UDP door's bind
@@ -143,7 +143,8 @@ door.serve(channel_client).await?;
 | [004](decisions/004-dial-callback-shape.md) | Ownership rides the handle | handle payloads own channel sessions; the session-teardown posture is inherited from **alktunnels ADR-005** (the consumer session type owns teardown) |
 | [005](decisions/005-auth-split-by-door.md) | Door auth | RFC 1929 at the door; static credential→identity mapping |
 | [007](decisions/007-bind-in-base.md) | BIND client | the reply#2 reader; vanilla clients via the door |
-| [011](decisions/011-inline-vendor.md) | The vendor | the client `use_stream` path in-tree |
+| [011](decisions/011-inline-vendor.md) | The extraction | the client `use_stream` path in-tree |
+| [013](decisions/013-targeted-fork.md) | The targeted fork | the core is owned (`src/rfc1928/`) |
 
 ## Open Questions