docs(comments): sweep em dashes from source comments, test prose, and manifest

Same treatment for the prose the compiler carries: doc and line comments
across src/ and tests/, test assertion and error-message strings (prose
surfaces: the tunnel-map registration/establish errors, the key-source
decode payload, assertion messages), scripts/matrix.sh comment lines,
the fuzz sidecar's comments and README (corpus seeds untouched), and the
Cargo.toml comment headers plus the crates.io description. The AGENTS.md
no-em-dash rule (convention 14) now holds for the whole tracked tree.

Verification: repo-wide git grep is clean (single exempt hit: the
verification command's own search pattern), cargo test (18 suites, zero
failures, default and per-feature builds via scripts/matrix.sh), clippy
--all-targets -D warnings and clippy all-features, fmt --check, doc
--no-deps, and the fuzz corpus gate (fuzz/shared, 11 tests) all green.

src/client_handler.rs

@@ -1,4 +1,4 @@
-//! The per-connection **client** handler — the dial surface's russh
+//! The per-connection **client** handler, the dial surface's russh
 //! `client::Handler` impl (`w4-dial`), the mirror of
 //! [`crate::handler`]'s server-direction handler.
 //!
@@ -9,46 +9,46 @@
 //!    the crate's single fingerprint path ([`crate::fingerprint`]),
 //!    labels it with the dial target (host + port, parsed from the
 //!    dial address), and hands the whole [`PresentedHostKey`] to the
-//!    injected [`HostKeyPolicy`] — the verdict rides straight through
-//!    (`Ok(policy.decide(..).await)`). The crate is policy-blind; the
+//!    injected [`HostKeyPolicy`], and the verdict rides straight
+//!    through (`Ok(policy.decide(..).await)`). The crate is policy-blind; the
 //!    built-in [`RejectAll`](crate::RejectAll) verdict makes every dial
 //!    refuse; a `false` verdict is the decline disposition russh
 //!    surfaces as its `UnknownKey` wire class
-//!    ([`DialError::HostKeyRejected`](crate::DialError)
-//!    — never an accept, never a retry).
+//!    ([`DialError::HostKeyRejected`](crate::DialError)),
+//!    never an accept, never a retry).
 //! 2. **Server-initiated channel opens declined cleanly** (ADR-003 §4,
 //!    the client-side symmetry rule): russh's default posture for every
-//!    `server_channel_open_*` hook is accept-and-drop — a
+//!    `server_channel_open_*` hook is accept-and-drop, a
 //!    half-capability the family forbids. Every hook is overridden
 //!    explicit-over-inherited. The `forwarded-tcpip` /
 //!    `forwarded-streamlocal` hooks (the `-R` data leg's types) route
-//!    through the **acceptor registry** ([`crate::client_accept`] —
+//!    through the **acceptor registry** ([`crate::client_accept`],
 //!    the `w4-reverse-listen` surface): served only under a registered
 //!    acceptor for that type and under the `tunnel` feature (the
 //!    [`with_tunnel_surface`]'s tunnel surface
-//!    wiring; a build without `tunnel` has no registry — every hook
+//!    wiring; a build without `tunnel` has no registry, so every hook
 //!    declines); unregistered/unfeatured opens answer
-//!    [`ChannelOpenFailure::AdministrativelyProhibited`] — a clean
+//!    [`ChannelOpenFailure::AdministrativelyProhibited`], a clean
 //!    wire-visible refusal the peer observes as an
 //!    unconfirmed open, never an accepted-then-dropped channel. The
 //!    accepted open's handoff spawns (the spawn-and-return rule's
 //!    client mirror): the hook accepts and returns fast, the duplex +
 //!    the open's fields ride the payload to the assembly's acceptor
-//!    call on its own task. Every other type has no registry slot —
+//!    call on its own task. Every other type has no registry slot:
 //!    the unknown-type gate
 //!    ([`Handler::should_accept_unknown_server_channel`]) answers
 //!    `false` (the hook's reject-before-open form; its `_unknown`
-//!    sibling stays a defensive reject — wire-reachable only if that
+//!    sibling stays a defensive reject, wire-reachable only if that
 //!    gate ever changed, also fail-closed), and the never-feature rows
 //!    (x11, agent) decline at any configuration.
 //!
 //! The accepted-open handoff carries a **bounded bookkeeping**
 //! counter (`AGENTS.md` convention 9, the cap relation recorded in
-//! [`crate::client_accept`]): a dedicated per-connection counter —
-//! sharing the dial's `Limits::max_concurrent_channels` ceiling the
-//! server direction's per-session cap uses — admitted in the hook
+//! [`crate::client_accept`]): a dedicated per-connection counter
+//! (sharing the dial's `Limits::max_concurrent_channels` ceiling the
+//! server direction's per-session cap uses), admitted in the hook
 //! before the accept, released when the handoff task ends (the
-//! acceptor's call completing *or the task unwinding* —
+//! acceptor's call completing *or the task unwinding*;
 //! [`crate::client_accept`]'s `HandoffCapGuard` panic-safety); a full
 //! counter declines the arrival cleanly
 //! (`cap-exceeded`).
@@ -79,7 +79,7 @@ use crate::{DialError, fingerprint};
 /// the two forwarded hooks route through, plus the accepted-open
 /// handoff counter and its ceiling (the dial's
 /// `Limits::max_concurrent_channels`; released when the handoff task
-/// ends — completion or unwind, `HandoffCapGuard`'s panic-safety).
+/// ends, completion or unwind, `HandoffCapGuard`'s panic-safety).
 #[cfg(feature = "tunnel")]
 pub(crate) struct TunnelSurface {
     acceptors: Arc<AcceptorRegistry>,
@@ -87,7 +87,7 @@ pub(crate) struct TunnelSurface {
     open_cap: std::sync::Arc<ChannelCap>,
 }
 
-/// The per-connection client handler the dial surface constructs —
+/// The per-connection client handler the dial surface constructs;
 /// see the module docs. Test surface
 /// (`#[doc(hidden)]` re-export from the crate root): the contract
 /// tests drive the bare hooks, exactly the
@@ -96,7 +96,7 @@ pub struct ClientHandler {
     policy: std::sync::Arc<dyn HostKeyPolicy>,
     host: String,
     port: u16,
-    /// The `-R` surface under `tunnel` (`Some` — the dial wires it;
+    /// The `-R` surface under `tunnel` (`Some`, the dial wires it;
     /// the bare-hook tests construct without it to pin the decline-all
     /// default posture in the featured builds too).
     #[cfg(feature = "tunnel")]
@@ -143,10 +143,10 @@ impl russh::client::Handler for ClientHandler {
 
     /// The host-key policy's hook (OQ-05): the presented key or
     /// certificate's fingerprint is computed on the crate's single
-    /// fingerprint path (certificates fingerprint their inner key —
+    /// fingerprint path (certificates fingerprint their inner key;
     /// the trust decision is the policy's either way) and the whole
     /// [`PresentedHostKey`] rides the policy; the verdict is passed
-    /// through untouched. `Ok(false)` — russh's decline — is the
+    /// through untouched. `Ok(false)`, russh's decline, is the
     /// disposition, never an error path; the policy's own record
     /// carries why.
     async fn check_server_key(
@@ -186,7 +186,7 @@ impl russh::client::Handler for ClientHandler {
     }
 
     /// The `forwarded-tcpip` hook (the `-R` data leg's gate): the
-    /// registry's slot read at arrival time — registered + room →
+    /// registry's slot read at arrival time (registered + room →
     /// accept and hand the assembly the open on a spawned task; no
     /// acceptor / no room → the clean decline, never accept-and-drop.
     async fn server_channel_open_forwarded_tcpip(
@@ -247,10 +247,10 @@ impl russh::client::Handler for ClientHandler {
         }
     }
 
-    /// The `forwarded-streamlocal` hook — the unix-slot's mirror of
+    /// The `forwarded-streamlocal` hook, the unix-slot's mirror of
     /// the tcpip gate (the ingestion is platform-neutral: no runtime
-    /// gate here; the listen rows carry the OQ-11 gate on the bind —
-    /// the recorded asymmetry, see [`crate::client_accept`]).
+    /// gate here; the listen rows carry the OQ-11 gate on the bind,
+    /// the recorded asymmetry (see [`crate::client_accept`]).
     async fn server_channel_open_forwarded_streamlocal(
         &mut self,
         channel: Channel<Msg>,
@@ -350,8 +350,8 @@ impl russh::client::Handler for ClientHandler {
         Ok(())
     }
 
-    /// A never-feature row (ADR-003 §5): x11 has no family seam — the
-    /// decline is not even registry territory.
+    /// A never-feature row (ADR-003 §5): x11 has no family seam, so
+    /// the decline is not even registry territory.
     async fn server_channel_open_x11(
         &mut self,
         channel: Channel<Msg>,
@@ -368,7 +368,7 @@ impl russh::client::Handler for ClientHandler {
     }
 
     /// A never-feature row (ADR-003 §5): agent forwarding is the
-    /// anti-pattern of the vault custody model — always declined.
+    /// anti-pattern of the vault custody model, always declined.
     async fn server_channel_open_agent_forward(
         &mut self,
         channel: Channel<Msg>,
@@ -384,7 +384,7 @@ impl russh::client::Handler for ClientHandler {
 
     /// Wire-reachable only if
     /// [`russh::client::Handler::should_accept_unknown_server_channel`]
-    /// ever answers `true` (it does not — the skeleton's default is
+    /// ever answers `true` (it does not; the skeleton's default is
     /// fail-closed); the defensive reject keeps the posture honest
     /// even then.
     async fn server_channel_open_unknown(
@@ -415,7 +415,7 @@ mod tests {
 
     /// - *Contract stamp:* ADR-004 decision 6 posture mirror (the
     ///   client-side: the policy is injected, the handler never
-    ///   decides trust), pinned at the dial wiring — here, that the
+    ///   decides trust), pinned at the dial wiring; here, that the
     ///   labels ride the construction so the policy sees
     ///   `PresentedHostKey { host, port }` verbatim, and the
     ///   fingerprint rides the crate's single fingerprint path.