docs(src): wave-1 gate polish — rustdoc links, doc typos, redundant test lines

- resolve 2 rustdoc broken-intra-doc-link warnings (ambiguous
  'async_trait' crate/attribute-macro name) in key_source.rs and
  host_key.rs
- fix stray ')' typo in the HostKeySource docs
- rewrite the stale lib.rs architecture line (dependency surface and
  feature graph are landed, not 'landing with implementation start')
- drop a discarded try_sign probe and a redundant None re-assignment
  in tests

Verification: cargo test 47/47 (default + --all-features), clippy
-D warnings (both feature configs, all targets), fmt --check,
cargo doc --no-deps 0 warnings

src/config.rs

@@ -462,7 +462,6 @@ mod tests {
         assert!(!serve.exec_wrapper_configured());
         assert!(!serve.tunnel_configured());
 
-        serve.exec_wrapper_argv = None;
         serve.exec_wrapper_argv = Some(vec!["/bin/sh".into(), "-c".into()]);
         assert!(serve.shell_configured());
         assert!(serve.exec_wrapper_configured());

src/host_key.rs

@@ -70,9 +70,9 @@ pub struct PresentedHostKey {
 ///
 /// The handle shape is the family's injected-handle pattern
 /// (`Arc<dyn HostKeyPolicy>`, the alkcall `IdentityProvider`
-/// precedent): object-safe via [`async_trait`], shared by reference —
-/// learn-and-record policies hold their state by interior mutability
-/// so the same handle serves the dial and any inspection.
+/// precedent): object-safe via `async_trait`, shared by
+/// reference — learn-and-record policies hold their state by interior
+/// mutability so the same handle serves the dial and any inspection.
 ///
 /// **Fail-closed posture**: when a policy cannot decide (its pin
 /// store is unavailable, its prompt failed, its metadata source is

src/key_source.rs

@@ -59,7 +59,7 @@ use crate::error::KeySourceError;
 ///
 /// The handle shape is the family's injected-handle pattern
 /// (`Arc<dyn KeySource>`, the alkcall `IdentityProvider` precedent):
-/// object-safe via [`async_trait`], shared by reference — the vault
+/// object-safe via `async_trait`, shared by reference — the vault
 /// handle rides the implementation (the assembly clones its
 /// [`VaultServiceHandle`] into its source). The crate's ADR-005
 /// implementation is [`VaultKeySource`]; an assembly may implement the
@@ -85,7 +85,7 @@ pub trait KeySource: Send + Sync + 'static {
 /// [`HostKeySource::load`] when it assembles the server, and a failure
 /// means no server is constructed (POC-2 §5; locked vault at
 /// bootstrap → [`KeySourceError::Locked`] → fail-closed, never a
-/// half-configured server). The crate is policy-blind on host *pin*)
+/// half-configured server). The crate is policy-blind on host *pin*
 /// trust — that is the [`crate::HostKeyPolicy`] seam's business — this
 /// seam is only the *held* material (the client's host pin is public
 /// config, never vault material).
@@ -293,7 +293,6 @@ mod tests {
     }
 
     fn assert_usable_by_russh(key: &russh::keys::PrivateKey) {
-        let _ = key.try_sign(b"alkssh w1 key-source usability probe");
         assert!(
             key.try_sign(b"alkssh w1 key-source usability probe")
                 .is_ok(),

src/lib.rs

@@ -19,8 +19,10 @@
 //! rest, decrypted at use (ADR-005), never env vars.
 //!
 //! Architecture: `docs/architecture/` (phase 1 — ADRs 001–006 accepted;
-//! the dependency surface and feature graph land with implementation
-//! start). See also `docs/research/` and family ADR-003.
+//! the dependency surface, feature graph, and wave-1 foundations are
+//! landed; the server stack, the mappings, the client direction, and
+//! validation are later implementation waves — wave 2 decomposes after
+//! this gate). See also `docs/research/` and family ADR-003.
 
 mod config;
 mod error;