docs: OQ-SK2-09 (the UDP door's peer-pin posture) + OQ-SK2-06's trigger-ownership check

- OQ-SK2-09 recorded: option 2 (the same-IP lock + reply-port
  refresh + the RFC drop rule) landed in 0.1.0 (31fb11c); option 3
  (the control-conn-derived expected peer — the complete fix)
  deferred on a concrete wildcard-bind deployment with address-level
  client mobility (QUIC migration is the likely driver); the
  deferred-index row added
- OQ-SK2-06: the trigger ownership checked (2026-09-28) — genuinely
  external by verified default (no suite-internal surface names a
  sandboxed alksocks consumer; the substrate is complete and
  gate-verified, nothing waits on nothing); the Schrödinger-bind
  check recorded in the OQ + the tracker task
- overview.md: the OQ index updated (SK2-09 added, SK2-06's
  ownership noted); the door bullet in the CHANGELOG carries the
  peer-pin posture + the async resolver note

Verification: cargo test + --all-features (15 suites each), clippy
--all-targets --all-features -D warnings clean, fmt clean, wasm check
clean, doc 0 warnings.

CHANGELOG.md

@@ -65,12 +65,16 @@ providers).
   constructor twins — the cred-bearing front door's re-origination).
 - **The `local` feature (ADR-008/009)** — the socket-backed seam
   providers (`tcp_dial` / `udp_egress` / `bind_accept` — the explicit
-  bind decisions), plus both doors: the consumer-side front doors
-  (`FrontDoor` — the NoAuth raw pipe + the RFC 1929 cred-bearing
-  door with the credential→identity mapping, ADR-005;
-  `UdpFrontDoor` — one association per bound relay socket, the RFC
-  codec at the door boundary only) and the producer-side listener
-  (`ProducerDoor` — vanilla clients dial it, each accepted
+  bind decisions, resolving via the non-blocking
+  `tokio::net::lookup_host` resolver), plus both doors: the
+  consumer-side front doors (`FrontDoor` — the NoAuth raw pipe + the
+  RFC 1929 cred-bearing door with the credential→identity mapping,
+  ADR-005; `UdpFrontDoor` — one association per bound relay socket,
+  the RFC codec at the door boundary only, the peer-pin posture: the
+  client's source IP pins on the first parsed datagram, replies
+  follow the latest-seen port from that IP, foreign-IP datagrams are
+  dropped per RFC 1928's MUST — OQ-SK2-09) and the producer-side
+  listener (`ProducerDoor` — vanilla clients dial it, each accepted
   connection is served via `serve_socks5_over`; the ADR-014
   idle-first-byte window + max-sessions cap knobs).
 - **The `composed` feature (ADR-008/009)** — the alktunnels 0.2.0