docs(research): phase 0 research set — vision, russh, auth bridge, mapping table, POC plan

The phase 0 document set (documented only; no POCs run yet):

- docs/research/vision.md — guiding principles (russh owns the wire,
  door-not-backend, fail-closed everything, one seam per mapping,
  family identity not SSH identity); non-goals (no sshd, no sftp until
  alkfs, no password auth); the five scope questions phase 0/1 must
  answer
- docs/research/russh.md — 0.64.1-era inventory: server/client
  Handler method tables, Config knobs, keys module (ssh-key re-export,
  fingerprint API), the RC-pinned dependency tree (ssh-key, rsa,
  pkcs1), MSRV/edition/license posture; alknet-main referenced as a
  rough example only, explicitly not decision input
- docs/research/auth-bridge.md — the alkcall mapping: no
  resolve_from_signature exists; the actual surface is
  IdentityProvider::resolve_from_fingerprint fed by russh-verified key
  fingerprints in auth_publickey; auth-method disposition matrix
  (only publickey implemented, all defaults overridden); client side
  mirrors alkhttp ADR-014 (key sources, not static keys; vault
  client-side only); the vault-to-russh-key bridge named as the
  missing design piece
- docs/research/mapping-table.md — the spine: channel-type rows with
  feature candidates and the verified sibling serve/consume entries
  (alktty drive_session, alkgit serve_duplex_resolved, alksocks
  serve_socks5_over, alktunnels consumer wrappers + the no-serve-over-
  stream absence note); request-level rows; parse-then-route dispatch
  inside the session channel; the alk/ssh ALPN topology question
  (ADR-004 reserved / ADR-034 stream_types [0,1] / ADR-042 hub never
  runs it); alktunnels route choice flagged for ADR
- docs/research/pocs.md — POC-1 (auth bridge + fail-closed declines
  against vanilla OpenSSH), POC-2 (vault-to-russh key bridge:
  PrivateKey extraction vs vault-backed Signer), POC-3 (mapping
  bake-off stages A-D: git exec, socks -D, tunnel -L, pty); all
  standalone mode; findings docs are the deliverables

Verification: cargo doc --no-deps, cargo fmt --check, cargo test
(docs-only change; lib untouched)

AGENTS.md

@@ -209,6 +209,22 @@ production code.
 ## Architecture Context
 
 - `docs/sdd_process.md` — the SDD process (phases, roles, task format)
+- `docs/research/` — phase 0 research (current source of truth for
+  design direction):
+  - `vision.md` — vision, guiding principles, non-goals, the phase 0
+    scope questions
+  - `russh.md` — russh crate inventory (server/client Handler, Config
+    knobs, keys module) and pin considerations (RC-pinned dep tree,
+    MSRV, license) — no alknet-derived bias; the pin is verified
+    against current russh at architecture time
+  - `auth-bridge.md` — russh auth ↔ alkcall `IdentityProvider` mapping
+    (server: verified-key fingerprint → `resolve_from_fingerprint`;
+    client: alkvault-backed key sources, `Signer`-shaped)
+  - `mapping-table.md` — the crate's spine: SSH channel type / request
+    → family protocol seam + cargo feature; the alktunnels
+    absence note; the `alk/ssh` ALPN topology question
+  - `pocs.md` — POC-1..3 plan (auth bridge, vault key bridge, mapping
+    bake-off) gating phase 0 completion
 - family docs: `/workspace/@alkdev/alkfamily/docs/` —
   `architecture/decisions/003-alkssh-russh-adapter.md` is the structural
   decision this repo builds from (and `002-alkforge-gitea-replacement.md`