chore: initialize crate base (manifest, lib stub, licensing, agents)

Phase 0 base for the russh-wrapped SSH adapter (family ADR-003):

- Cargo.toml: single-crate alkssh 0.1.0, MIT OR Apache-2.0, lib only,
  publish exclude list matching the sibling-crate policy; deliberately
  empty [dependencies] — the russh pin is phase 0 research output
  (alknet main's 0.49 is a data point, not the decision). [features]
  carries the fail-closed posture as a comment until the capability
  feature graph lands with the committed architecture
- src/lib.rs: crate-root doc describing the adapter shape and the
  fail-closed feature contract
- LICENSE-MIT / LICENSE-APACHE (alktty's standard texts)
- .gitignore (target/, node_modules/, .worktrees/)
- CHANGELOG.md: Keep a Changelog stub, [Unreleased] initialization
- AGENTS.md: full agent operating instructions — git workflow
  (conventional commits, commit-and-push), 13 project conventions
  (russh owns the wire, fail-closed capability features, key reuse via
  alkvault-backed sources, visible-surface=authorized-surface,
   ALPN as one-way door), verification commands, taskgraph
  task rules, SDD phase 0 lifecycle status, architecture context

Verification: cargo build/test/clippy --all-targets -D warnings and
cargo fmt --check all pass (lib stub, zero deps)

src/lib.rs

@@ -0,0 +1,22 @@
+//! alkssh — the alk family's SSH adapter (the alkhttp-style door for the
+//! SSH protocol): a thin wrapper around russh terminating the vanilla-ssh
+//! wire and bridging to/from alkcall channels (the `alk/ssh` ALPN).
+//!
+//! No SSH framing is authored in-family (family ADR-003): russh owns the
+//! wire, and the crate's substance is the channel-type mappings —
+//! session/pty → alktty, direct/forwarded-tcpip → alktunnels, dynamic
+//! forwarding (`-D`) → alksocks, git exec/subsystem → alkgit, sftp →
+//! alkfs later. Every mapping is a cargo feature; a session opening an
+//! unfeatured or unimplemented channel type is declined with a clean
+//! error — never a half-capability, never a silent fallback. The default
+//! build (no features) is structurally incapable of serving anything but
+//! declines.
+//!
+//! Keys reuse the alknet `main` key model (`russh::keys`,
+//! authorized-key/KeySource handling) via alkvault-backed sources — never
+//! env vars.
+//!
+//! This crate is initialized (docs only, SDD phase 0): the dependency
+//! surface, the feature graph, and the mapping table are phase 0 research
+//! output and land with the committed architecture. See
+//! `docs/research/` and family ADR-003.