docs(architecture): review-pass cleanup — inconsistencies, stale refs, scaffolding refresh

- OQ-02: rewritten as a clean resolved statement; contradictory
  deferred-table row removed
- OQ-05: 'old-code anti-pattern' framing corrected — ephemeral-fleet
  accept-and-continue is a legitimate case-2 HostKeyPolicy; the crate
  rule is 'no hard-coded trust model', not 'accept-all forbidden';
  dangling 'expected ADR-007' pointer replaced with the real contract
  locations (auth.md, client.md)
- README: OQ counts corrected (6 resolved / 3 open / 4 deferred);
  sibling references normalized to real ADR IDs (alkcall 010 is alkhttp
  014's analog; 'ADR-016-analog' was a wrong number)
- client/auth: OQ-07 status corrected to resolved-at-adapter-level;
  TOFO typo; TOFU framing
- ADR-004: dangling 'ADR-008' -> serve-config defaults
- ADR-006: SOCKS5 typo
- mapping: alktty typo; '(OQ-… note below)' placeholder -> the real
  POC-3 note reference
- research: cross-repo numbers qualified (alktty OQ-44, alkvault
  ADR-021); reverse-runner lesson 5 reframed per correction
- scaffolding: Cargo.toml description/comments and src/lib.rs doc
  comment updated against ADR-002/003/006 (dynamic-forward retired,
  git exec-only, russh pin decided); CHANGELOG logs POC completion and
  ADRs 001-006

Verification: cargo test, cargo clippy --all-targets -- -D warnings,
cargo fmt --check, cargo check — all pass

src/lib.rs

@@ -4,19 +4,20 @@
 //!
 //! No SSH framing is authored in-family (family ADR-003): russh owns the
 //! wire, and the crate's substance is the channel-type mappings —
-//! session/pty → alktty, direct/forwarded-tcpip → alktunnels, dynamic
-//! forwarding (`-D`) → alksocks, git exec/subsystem → alkgit, sftp →
-//! alkfs later. Every mapping is a cargo feature; a session opening an
-//! unfeatured or unimplemented channel type is declined with a clean
-//! error — never a half-capability, never a silent fallback. The default
-//! build (no features) is structurally incapable of serving anything but
-//! declines.
+//! session/pty → alktty, direct/forwarded-tcpip → alktunnels, git exec →
+//! alkgit, sftp → alkfs later (a declining placeholder until then), each
+//! behind its cargo feature. Git over SSH is exec-only (ADR-006): a
+//! subsystem request can never carry the repository, so it declines. A
+//! client opening an unfeatured or unimplemented channel type gets a
+//! clean decline — never a half-capability, never a silent fallback; the
+//! default build (no features) is structurally incapable of serving
+//! anything but declines.
 //!
-//! Keys reuse the alknet `main` key model (`russh::keys`,
-//! authorized-key/KeySource handling) via alkvault-backed sources — never
-//! env vars.
+//! Identity is the family's, not SSH's: a verified key's fingerprint →
+//! alkcall `IdentityProvider`. Keys the crate holds (client dial keys,
+//! host keys) come from alkvault-backed sources — vault-encrypted at
+//! rest, decrypted at use (ADR-005), never env vars.
 //!
-//! This crate is initialized (docs only, SDD phase 0): the dependency
-//! surface, the feature graph, and the mapping table are phase 0 research
-//! output and land with the committed architecture. See
-//! `docs/research/` and family ADR-003.
+//! Architecture: `docs/architecture/` (phase 1 — ADRs 001–006 accepted;
+//! the dependency surface and feature graph land with implementation
+//! start). See also `docs/research/` and family ADR-003.