docs(architecture): review-pass cleanup — inconsistencies, stale refs, scaffolding refresh

- OQ-02: rewritten as a clean resolved statement; contradictory
  deferred-table row removed
- OQ-05: 'old-code anti-pattern' framing corrected — ephemeral-fleet
  accept-and-continue is a legitimate case-2 HostKeyPolicy; the crate
  rule is 'no hard-coded trust model', not 'accept-all forbidden';
  dangling 'expected ADR-007' pointer replaced with the real contract
  locations (auth.md, client.md)
- README: OQ counts corrected (6 resolved / 3 open / 4 deferred);
  sibling references normalized to real ADR IDs (alkcall 010 is alkhttp
  014's analog; 'ADR-016-analog' was a wrong number)
- client/auth: OQ-07 status corrected to resolved-at-adapter-level;
  TOFO typo; TOFU framing
- ADR-004: dangling 'ADR-008' -> serve-config defaults
- ADR-006: SOCKS5 typo
- mapping: alktty typo; '(OQ-… note below)' placeholder -> the real
  POC-3 note reference
- research: cross-repo numbers qualified (alktty OQ-44, alkvault
  ADR-021); reverse-runner lesson 5 reframed per correction
- scaffolding: Cargo.toml description/comments and src/lib.rs doc
  comment updated against ADR-002/003/006 (dynamic-forward retired,
  git exec-only, russh pin decided); CHANGELOG logs POC completion and
  ADRs 001-006

Verification: cargo test, cargo clippy --all-targets -- -D warnings,
cargo fmt --check, cargo check — all pass

Cargo.toml

@@ -1,6 +1,6 @@
 # Single-crate protocol/door crate (the alktty template). No workspace:
 # the composition story is deferred — alkssh's substance is the mappings
-# (family ADR-003), and phase 0 research settles the russh pin first.
+# (family ADR-003); the russh pin is decided (ADR-002: 0.65.0, aws-lc-rs).
 [workspace]
 members = ["."]
 
@@ -10,7 +10,7 @@ version = "0.1.0"
 edition = "2021"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"
-description = "SSH adapter for the alk family: russh-wrapped vanilla-ssh termination bridged to/from alkcall channels — session/pty, tunnels, dynamic forwarding, git exec/subsystem — with every capability mapping a fail-closed cargo feature (no features: no capabilities)"
+description = "SSH adapter for the alk family: russh-wrapped vanilla-ssh termination bridged to/from alkcall channels — session/pty, tunnels, git exec — with every capability mapping a fail-closed cargo feature (no features: no capabilities)"
 repository = "https://git.alk.dev/alkdev/alkssh"
 keywords = ["ssh", "russh", "protocol", "alkcall", "network"]
 categories = ["network-programming", "asynchronous"]
@@ -24,18 +24,18 @@ exclude = [".opencode/", "AGENTS.md", "docs/reviews/", "docs/plans/", "docs/rese
 name = "alkssh"
 
 [features]
-# The capability feature graph (family ADR-003 decision 3) lands with the
-# committed architecture: session (→ alktty), tunnel (→ alktunnels),
-# dynamic-forward (→ alksocks), git (→ alkgit), sftp (→ alkfs, deferred).
-# The default build carries no capabilities by design — every mapping is
-# opt-in and every unfeatured channel open declines fail-closed.
+# The capability feature graph (ADR-003) lands with implementation start:
+# session (→ alktty), tunnel (→ alktunnels), git (→ alkgit), sftp (→
+# alkfs, deferred placeholder). The default build carries no capabilities
+# by design — every mapping is opt-in and every unfeatured channel open
+# declines fail-closed.
 default = []
 
 [dependencies]
 tokio = { version = "1.54.1", features = ["full"] }
-# Deliberately empty at initialize time — the russh version pin is phase 0
-# research output (alknet main's `russh = "0.49"` is the reference, not the
-# answer). alkcall + sibling-crate deps land with the committed architecture.
+# Deliberately empty until implementation start — the russh pin is decided
+# (ADR-002: 0.65.0, aws-lc-rs); russh + alkcall + sibling-crate deps land
+# with implementation.
 
 [dev-dependencies]