vendor: crate scaffolding — Cargo.toml, lib.rs, vendor skeleton, license notice

- Cargo.toml: alksocks 0.1.0 in the sibling posture (alktunnels-style
  exclude/keywords/description); empty `local` + `composed` features
  declared (ADR-009 §Amendment — populated by their modules' tasks);
  deps = tokio wasm-clean subset (rt/sync/io-util/macros/time),
  tracing, thiserror; full tokio dev-deps. No alkcall, no net-shaped
  deps (the producer/consumer tasks pin alkcall 0.8.0).
- src/lib.rs: forbid(unsafe_code), crate docs (never-binds posture,
  vendor provenance, architecture pointer), `pub mod vendor;`.
- src/vendor/: skeleton preserving upstream fast-socks5 v1.0.0 file
  names for mechanical per-file diffs — mod.rs (provenance doc +
  server/client/util declarations), five stubs for the extraction
  tasks; socks4/ cut per ADR-011 §Amendment.
- src/vendor/LICENSE: upstream MIT text + v1.0.0 attribution header,
  referenced from the vendor module doc (ADR-011's license
  obligation; upstream has no per-file headers).
- tasks/implementation/vendor-crate-scaffolding.md: completed
  (checkboxes, notes, summary).

Verification: cargo test; clippy --all-targets -- -D warnings;
fmt --check; cargo check + clippy --target wasm32-unknown-unknown
with -D warnings — all clean; wasm gate green from birth.

tasks/implementation/vendor-crate-scaffolding.md

@@ -1,7 +1,7 @@
 ---
 id: implementation/vendor-crate-scaffolding
 name: Vendor — crate scaffolding (Cargo.toml, lib.rs, vendor module skeleton, license notice)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -60,17 +60,17 @@ Deliverables:
 
 ## Acceptance Criteria
 
-- [ ] `cargo test` passes (empty crate compiles and runs)
-- [ ] `cargo clippy --all-targets -- -D warnings` clean
-- [ ] `cargo fmt --check` clean
-- [ ] `cargo check --target wasm32-unknown-unknown` clean (the wasm gate
+- [x] `cargo test` passes (empty crate compiles and runs)
+- [x] `cargo clippy --all-targets -- -D warnings` clean
+- [x] `cargo fmt --check` clean
+- [x] `cargo check --target wasm32-unknown-unknown` clean (the wasm gate
       is green from birth — no `mio`/`socket2`/`tokio::net` in the graph)
-- [ ] `cargo clippy --target wasm32-unknown-unknown -- -D warnings` clean
-- [ ] `Cargo.toml` has no `alkcall`, no `anyhow`, no `log`, no
+- [x] `cargo clippy --target wasm32-unknown-unknown -- -D warnings` clean
+- [x] `Cargo.toml` has no `alkcall`, no `anyhow`, no `log`, no
       `async-trait`, no `tokio-stream`, no `socket2` in `[dependencies]`
-- [ ] `src/vendor/LICENSE` exists with the MIT text + v1.0.0 attribution,
+- [x] `src/vendor/LICENSE` exists with the MIT text + v1.0.0 attribution,
       referenced from the vendor module doc
-- [ ] `#![forbid(unsafe_code)]` present in `lib.rs`
+- [x] `#![forbid(unsafe_code)]` present in `lib.rs`
 
 ## References
 
@@ -86,8 +86,55 @@ Deliverables:
 
 ## Notes
 
-> To be filled by implementation agent
+- **Cargo.toml** follows the alktunnels posture (the closer sibling —
+  same tokio wasm-clean subset incl. `time`, same dev-dep tokio
+  shape): `exclude` mirrors alktunnels (docs/research/ + tasks/ +
+  sdd_process.md); keywords/categories/description point at the
+  SOCKS5 story; repository is the git.alk.dev remote. `[features]`
+  declares `default`/`local`/`composed` empty (ADR-009 §Amendment —
+  populated by their modules' tasks); `[dependencies]` is exactly the
+  task's trio (tokio wasm-clean subset, tracing, thiserror — no
+  alkcall, no net-shaped anything). A `[lib]` section pins the crate
+  name, matching the siblings.
+- **lib.rs** — `#![forbid(unsafe_code)]`, crate docs (what the crate
+  is, the never-binds posture, the vendor provenance pointer, the
+  overview.md link), `pub mod vendor;`. Nothing else: later tasks add
+  their own modules + re-exports.
+- **src/vendor/** skeleton preserves upstream v1.0.0 file names for
+  mechanical per-file diffs: `mod.rs` (provenance module doc +
+  submodule declarations), `server.rs`, `client.rs`,
+  `util/{mod,stream,target_addr}.rs` — the five files the extraction
+  tasks fill. Stubs carry one-line module docs naming their filling
+  task and (for the util files) the cut-region note; `util/mod.rs`
+  pre-declares `stream` + `target_addr` exactly as upstream does.
+  `socks4/` is deliberately absent (the cut).
+- **src/vendor/LICENSE** — the upstream MIT text verbatim (Copyright
+  (c) 2025 Jonathan Dizdarevic, per `/workspace/fast-socks5/LICENSE`)
+  under a provenance header (v1.0.0, github.com/dizda/fast-socks5,
+  ADR-011 pointer, vendor.md pointer); referenced from the `mod.rs`
+  module doc via an intra-doc link. The upstream license has no
+  "MIT License" body-text title line — it opens with "MIT License"
+  + copyright; the notice keeps that text verbatim after the header.
+- Verification ran clean: `cargo test` (0 tests, compiles + runs),
+  clippy `--all-targets -- -D warnings`, `cargo fmt --check`,
+  `cargo check --target wasm32-unknown-unknown`, and
+  `cargo clippy --target wasm32-unknown-unknown -- -D warnings` —
+  the wasm gate is green from birth (the dep graph is tokio-wasm-
+  subset + tracing + thiserror only).
 
 ## Summary
 
-> To be filled on completion
+Created the `alksocks` 0.1.0 crate skeleton per the task: `Cargo.toml`
+(sibling posture; empty `local`/`composed` features declared; tokio
+wasm-clean subset `rt/sync/io-util/macros/time`, `tracing`,
+`thiserror`; no alkcall/net-shaped deps; full tokio dev-deps for
+native tests), `src/lib.rs` (`#![forbid(unsafe_code)]`, crate docs
+pointing at the architecture spec set, `pub mod vendor;`), the
+`src/vendor/` skeleton preserving upstream fast-socks5 v1.0.0 file
+names (`mod.rs` with the provenance/extract-not-copy module doc +
+`server`/`client`/`util` declarations; five stub files for the
+extraction tasks; `socks4/` cut), and `src/vendor/LICENSE` (upstream
+MIT text + v1.0.0 attribution header, referenced from the vendor
+module doc). All acceptance criteria verified: test/clippy/fmt clean
+natively, both wasm checks clean, dep surface clean, license notice
+in place, forbid-unsafe present.