feat(config): land the wave-3 per-feature family-seam handles (w3-seam-config)

- ServeConfig gains cfg-gated SessionSeam / GitSeam Option fields
  (whole-Option struct per seam — the shape decision recorded in the
  task notes): unset → the owned rows decline even though the feature
  is on, no construction-time validation
- SessionSeam carries the alktty backends map + backend selector +
  ownership provider; GitSeam carries the alkgit backend quartet +
  caller-owned pipeline semaphore + push_options_negotiated
- optional deps alktty 0.8.1 / alkgit 0.1.0 wired feature-to-dep
  (pins verified against crates.io: licenses, MSRV, shared alkcall
  resolution); gix-hash 0.28 as dev-dep only (alkgit does not
  re-export ObjectId for the trait doubles)
- per-feature construction/unset-declines/Debug rows in config.rs;
  accessors session_seam_configured / git_seam_configured; docs state
  what each seam handle carries

Verified: cargo test (per-feature + --all-features), clippy ×2
(-D warnings), fmt, cargo doc --no-deps, cargo tree feature isolation
(git-build: no alktty; session-build: no alkgit), taskgraph validate

Cargo.toml

@@ -26,12 +26,16 @@ name = "alkssh"
 [features]
 # ADR-003: flat and independent — no feature implies another; `default = []`
 # by design (a default build has no capabilities; every unfeatured open
-# declines fail-closed). Features gate nothing yet — the wave-2 decline core
-# is their first consumer; the per-feature sibling deps land with their
-# first consuming wave.
+# declines fail-closed). The wave-2 decline core is the first `cfg`
+# consumer; the wave-3 seam-config handles are the second (each optional
+# sibling dep is gated feature-to-dep so a git-build never compiles
+# alktty and vice versa — the wave-1 manifest rule: per-feature sibling
+# deps land with their first consuming wave, which for alktty/alkgit is
+# the wave-3 config fields; alktunnels still lands with its first
+# consuming code, w3-tunnel-direct).
 default = []
-session = []
-git = []
+session = ["dep:alktty"]
+git = ["dep:alkgit"]
 tunnel = []
 sftp = []
 
@@ -46,6 +50,14 @@ async-trait = "0.1"
 russh = { version = "0.65", default-features = false, features = ["aws-lc-rs"] }
 alkcall = "0.10"
 alkvault = "0.1"
+# Wave-3 seam-handle types (`config.rs`'s `SessionSeam`/`GitSeam`).
+# Pins verified against crates.io (2026-10-28): alktty 0.8.1, alkgit
+# 0.1.0 — both MIT OR Apache-2.0, both rust_version 1.88 ≤ our 1.89,
+# both over alkcall ^0.10 (shared with our `alkcall = "0.10"` → 0.10.1
+# resolution). alktty's `local` feature stays off — alkssh never
+# touches a real backend; the `local` shapes stay alktty-side.
+alktty = { version = "0.8.1", default-features = false, optional = true }
+alkgit = { version = "0.1.0", default-features = false, optional = true }
 tokio = { version = "1.54", features = ["full"] }
 thiserror = "2.0"
 tracing = "0.1"
@@ -53,6 +65,10 @@ parking_lot = "0.12"
 zeroize = "1.9"
 
 [dev-dependencies]
+# The git-seam test doubles name `GitPackGen`'s `gix_hash::ObjectId`
+# parameters and alkgit does not re-export them — test-graph only,
+# version matched to alkgit's `^0.28` req (same crate in the lockfile).
+gix-hash = { version = "0.28", features = ["sha1"] }
 
 [profile.release]
 lto = "thin"