docs: pin the vendor scope as extraction — the net gate dissolves

Complete the ADR-011 §Amendment (extraction, not wholesale-copy-plus-
gate) across every doc that stated the pre-amendment posture:

- ADR-011: add the two extraction-recipe exclusions the amendment
  missed (the socks4 module — upstream's separate default-off cargo
  feature, out of RFC 1928 scope; the legacy Config/Authentication
  auth layer — ungated but consumed only by the cut region) and the
  dependency-surface adjustments (log -> tracing, anyhow dropped,
  async-trait dropped with its legacy-layer uses)
- ADR-009: amend — the vendor's net gate dissolves; features collapse
  to local + composed; local carries tokio/net + socket2 itself
- vendor.md: replace the contradictory old "four carried changes"
  section with the two-change reading + extraction-time adjustments;
  extend the cut table (socks4 row, legacy auth layer)
- overview.md: dependency diagram + feature table drop the net
  feature; module map reflects two carried changes
- README.md: principles 7/8 + doc/ADR tables updated
- ADR-002/012, open-questions.md (OQ-SK-04), phase-0.md current-state
  sections, AGENTS.md conventions 4/17 + stale wasm-caveat sentence,
  POC findings posture notes: aligned with the extraction

Verification: repo-wide grep for stale "four carried"/default-on net/
implies-net statements returns only amendment-context matches;
extraction recipe re-verified against POC #4's gate map and the
fast-socks5 v1.0.0 source (async-trait usage confined to the cut
legacy layer; AuthMethod<T> traits are native async-fn-in-trait).

AGENTS.md

@@ -90,10 +90,14 @@ implementation agents.
    (`rt`, `sync`, `io-util`, `macros`, `time`) — **do NOT use `features
    = ["full"]`** — and keep socket/platform I/O feature-gated. Note:
    `fast-socks5` uses `tokio::net` and `socket2` unconditionally as
-   published; the posture is the inline vendor (OQ-SK-04, resolved
-   2026-09-20 — convention 17): vendor the `T`-generic subset, gate
-   native-net pieces behind a default-on `net`-shaped feature. Run
-   the wasm check whenever a non-backend module changes.
+   published; the posture is the inline vendor as an **extraction**
+   (OQ-SK-04, resolved 2026-09-20 — convention 17; extraction pinned
+   2026-09-21, ADR-011 §Amendment): extract the `T`-generic subset
+   only — the kernel-net handlers are not copied, so the vendor is
+   wasm-clean by construction with no `net`-shaped feature; socket
+   I/O rides `local` alone. Run the wasm check whenever a non-backend
+   module changes; it is a hard gate (no dependency-graph failure is
+   expected — the extraction contains no `tokio::net`).
 
 5. **Wire format is stable** — the SOCKS5 protocol itself is RFC 1928
    (fixed); this crate's wire surface is the ALPN + the channel open-op
@@ -238,12 +242,14 @@ implementation agents.
     sweep landed in alkcall 0.8.0 / alktunnels 0.2.0). `fast-socks5`
     is NOT ours — it is third-party upstream (`/workspace/fast-socks5`
     is a read-only reference checkout, v1.0.0, MIT). The posture is
-    the **inline vendor** (OQ-SK-04, resolved 2026-09-20): vendor the
-    `T`-generic subset into this crate, gated behind a default-on
-    `net`-shaped feature, and carry the wrapper's needs in-tree (the
-    wasm gate, BIND, the `run_udp_proxy_custom` bind seam, the
-    `new_reply` publication). Offering the net-gate upstream as a
-    courtesy PR stays optional; never wait on it. Keep
+    the **inline vendor as an extraction** (OQ-SK-04, resolved
+    2026-09-20; extraction pinned 2026-09-21, ADR-011 §Amendment):
+    extract the `T`-generic subset only — the kernel-net handlers and
+    the `socks4` module are not copied — and carry the wrapper's
+    needs in-tree (BIND, the `new_reply` publication; the `net` gate
+    and the `run_udp_proxy_custom` bind seam dissolve with the
+    kernel-net region). Offering the net-gate upstream as a courtesy
+    PR stays optional; never wait on it. Keep
     `/workspace/fast-socks5` for differential testing of RFC edge
     cases; note the vendor point (v1.0.0) in the vendored code.
 
@@ -264,9 +270,9 @@ cargo publish --dry-run --allow-dirty         # before a release
 
 The wasm check is the structural guard for the "default crate is
 wasm-clean" invariant (same as alktty/alktunnels) — run it whenever a
-non-backend module changes. Until OQ-SK-04 (fast-socks5 wasm posture) is
-resolved, the wasm check may fail on the dependency graph; that failure
-is expected and is exactly what the OQ tracks.
+non-backend module changes. It is a hard gate: the vendor is an
+extraction with no kernel-net code (ADR-011 §Amendment), so no
+dependency-graph failure is expected.
 
 ## Architecture Context
 
@@ -309,10 +315,11 @@ is expected and is exactly what the OQ tracks.
     `run_tcp_proxy` / `run_udp_proxy_custom` / `transfer` are the
     interception points; client side has `Socks5Stream` (generic over
     the backing socket) and `Socks5Datagram` (UDP associate). The
-    posture is the inline vendor (OQ-SK-04, resolved 2026-09-20 —
-    convention 17): the `T`-generic subset is vendored into this
-    crate behind a `net`-shaped feature, with BIND and the seam fixes
-    carried in-tree.
+    posture is the inline vendor as an extraction (OQ-SK-04, resolved
+    2026-09-20; extraction pinned 2026-09-21, ADR-011 §Amendment —
+    convention 17): the `T`-generic subset is extracted into this
+    crate with no kernel-net code and no `net` feature; BIND and the
+    `new_reply` publication are the two carried changes.
   - **alknet's SOCKS5 client** —
     `/workspace/@alkdev/alknet/crates/alknet-client/src/socks5.rs`
     (ADR-090): the client-side example need — `Socks5UdpSocket`