vendor: crate scaffolding — Cargo.toml, lib.rs, vendor skeleton, license notice

- Cargo.toml: alksocks 0.1.0 in the sibling posture (alktunnels-style
  exclude/keywords/description); empty `local` + `composed` features
  declared (ADR-009 §Amendment — populated by their modules' tasks);
  deps = tokio wasm-clean subset (rt/sync/io-util/macros/time),
  tracing, thiserror; full tokio dev-deps. No alkcall, no net-shaped
  deps (the producer/consumer tasks pin alkcall 0.8.0).
- src/lib.rs: forbid(unsafe_code), crate docs (never-binds posture,
  vendor provenance, architecture pointer), `pub mod vendor;`.
- src/vendor/: skeleton preserving upstream fast-socks5 v1.0.0 file
  names for mechanical per-file diffs — mod.rs (provenance doc +
  server/client/util declarations), five stubs for the extraction
  tasks; socks4/ cut per ADR-011 §Amendment.
- src/vendor/LICENSE: upstream MIT text + v1.0.0 attribution header,
  referenced from the vendor module doc (ADR-011's license
  obligation; upstream has no per-file headers).
- tasks/implementation/vendor-crate-scaffolding.md: completed
  (checkboxes, notes, summary).

Verification: cargo test; clippy --all-targets -- -D warnings;
fmt --check; cargo check + clippy --target wasm32-unknown-unknown
with -D warnings — all clean; wasm gate green from birth.

src/lib.rs

@@ -0,0 +1,23 @@
+//! alksocks — SOCKS5 (RFC 1928) as a produced resource on alkcall
+//! channels.
+//!
+//! A producer/consumer protocol crate (the alktty/alktunnels shape):
+//! the producer half registers the `channels/socks5/sub` open op and
+//! drives the RFC 1928 conversation in-stream over the channel's
+//! `BiStream`; the consumer half opens SOCKS5 channels and speaks the
+//! protocol inside them. The defining posture: the protocol never
+//! binds a port — kernel binds exist only as explicit, feature-gated
+//! assembly shapes (`local`), never in the protocol layer.
+//!
+//! The RFC wire vocabulary and the explicit typestate live in
+//! [`vendor`]: an extraction of fast-socks5 v1.0.0's `T`-generic
+//! subset (MIT, third-party upstream) carrying two deliberate changes
+//! (BIND support, `new_reply` publication) — see
+//! `docs/architecture/vendor.md` and ADR-011.
+//!
+//! Architecture: `docs/architecture/overview.md` (spec set:
+//! wire.md, producer.md, consumer.md, vendor.md).
+
+#![forbid(unsafe_code)]
+
+pub mod vendor;

src/vendor/LICENSE

@@ -0,0 +1,35 @@
+The MIT License (MIT)
+
+https://github.com/dizda/fast-socks5
+
+Copyright (c) 2025 Jonathan Dizdarevic
+
+The files under this `src/vendor/` directory are an extraction of
+fast-socks5 v1.0.0 (https://github.com/dizda/fast-socks5), carried
+in-tree by alksocks under ADR-011 (docs/architecture/decisions/
+011-inline-vendor.md). Upstream has no per-file license headers; this
+bundled notice is the license obligation's carrier. The extraction
+cut and the carried changes are recorded in
+docs/architecture/vendor.md.
+
+---
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/vendor/client.rs

@@ -0,0 +1,2 @@
+//! Vendored from fast-socks5 v1.0.0 (extraction — see the module doc
+//! in `mod.rs`; filled by the client-session extraction task).

src/vendor/mod.rs

@@ -0,0 +1,27 @@
+//! The inline vendor: an extraction of fast-socks5 v1.0.0's
+//! `T`-generic subset (MIT, third-party upstream —
+//! github.com/dizda/fast-socks5; `/workspace/fast-socks5` is the
+//! read-only reference checkout, kept for differential testing of RFC
+//! edge cases).
+//!
+//! Extracted per ADR-011 §Amendment (docs/architecture/decisions/
+//! 011-inline-vendor.md): only the code already generic over
+//! `T: AsyncRead + AsyncWrite + Unpin` rides in-tree — the kernel-net
+//! handlers, the `socks4` module, and the legacy `Config`/
+//! `Authentication` layer are **not** copied. The extraction cut, the
+//! two carried changes (BIND support, `new_reply` publication), and
+//! the extraction-time adjustments (no `anyhow`, no `log`, no
+//! `async-trait`) are recorded in `docs/architecture/vendor.md`.
+//!
+//! License: upstream is MIT with no per-file headers — the bundled
+//! notice in [`this module's LICENSE file`](LICENSE) (v1.0.0
+//! attribution) is the license obligation's carrier.
+//!
+//! Maintenance posture: the vendored code is first-class, co-evolves
+//! with the wrapper, and is the crate's only RFC 1928 wire vocabulary
+//! ("no second codec, ever" — ADR-011). A future upstream release is
+//! re-based against deliberately, never absorbed silently.
+
+pub mod client;
+pub mod server;
+pub mod util;

src/vendor/server.rs

@@ -0,0 +1,2 @@
+//! Vendored from fast-socks5 v1.0.0 (extraction — see the module doc
+//! in `mod.rs`; filled by the server-typestate extraction task).

src/vendor/util/mod.rs

@@ -0,0 +1,9 @@
+//! Vendored from fast-socks5 v1.0.0 (extraction — see the module doc
+//! in the vendor root's `mod.rs`).
+//!
+//! Upstream layout: `stream.rs` (the `read_exact!`/`ready!` macros +
+//! `ConnectError`) and `target_addr.rs` (`TargetAddr` + the address
+//! codec) — filled by the wire-vocabulary extraction task.
+
+pub mod stream;
+pub mod target_addr;

src/vendor/util/stream.rs

@@ -0,0 +1,7 @@
+//! Vendored from fast-socks5 v1.0.0 (extraction — see the module doc
+//! in the vendor root's `mod.rs`; filled by the wire-vocabulary
+//! extraction task).
+//!
+//! Upstream carries the `read_exact!`/`ready!` macros, `ConnectError`,
+//! and the `tcp_connect*` dialers; only the first two ride the
+//! extraction (the dialers are the cut kernel-net region).

src/vendor/util/target_addr.rs

@@ -0,0 +1,7 @@
+//! Vendored from fast-socks5 v1.0.0 (extraction — see the module doc
+//! in the vendor root's `mod.rs`; filled by the wire-vocabulary
+//! extraction task).
+//!
+//! Upstream carries `TargetAddr`, the address codec (`read_address`),
+//! and the `resolve_dns` helper; only the codec rides the extraction
+//! (DNS resolution is the cut net region).