docs(research): phase 0 research set — vision, russh, auth bridge, mapping table, POC plan

The phase 0 document set (documented only; no POCs run yet):

- docs/research/vision.md — guiding principles (russh owns the wire,
  door-not-backend, fail-closed everything, one seam per mapping,
  family identity not SSH identity); non-goals (no sshd, no sftp until
  alkfs, no password auth); the five scope questions phase 0/1 must
  answer
- docs/research/russh.md — 0.64.1-era inventory: server/client
  Handler method tables, Config knobs, keys module (ssh-key re-export,
  fingerprint API), the RC-pinned dependency tree (ssh-key, rsa,
  pkcs1), MSRV/edition/license posture; alknet-main referenced as a
  rough example only, explicitly not decision input
- docs/research/auth-bridge.md — the alkcall mapping: no
  resolve_from_signature exists; the actual surface is
  IdentityProvider::resolve_from_fingerprint fed by russh-verified key
  fingerprints in auth_publickey; auth-method disposition matrix
  (only publickey implemented, all defaults overridden); client side
  mirrors alkhttp ADR-014 (key sources, not static keys; vault
  client-side only); the vault-to-russh-key bridge named as the
  missing design piece
- docs/research/mapping-table.md — the spine: channel-type rows with
  feature candidates and the verified sibling serve/consume entries
  (alktty drive_session, alkgit serve_duplex_resolved, alksocks
  serve_socks5_over, alktunnels consumer wrappers + the no-serve-over-
  stream absence note); request-level rows; parse-then-route dispatch
  inside the session channel; the alk/ssh ALPN topology question
  (ADR-004 reserved / ADR-034 stream_types [0,1] / ADR-042 hub never
  runs it); alktunnels route choice flagged for ADR
- docs/research/pocs.md — POC-1 (auth bridge + fail-closed declines
  against vanilla OpenSSH), POC-2 (vault-to-russh key bridge:
  PrivateKey extraction vs vault-backed Signer), POC-3 (mapping
  bake-off stages A-D: git exec, socks -D, tunnel -L, pty); all
  standalone mode; findings docs are the deliverables

Verification: cargo doc --no-deps, cargo fmt --check, cargo test
(docs-only change; lib untouched)

CHANGELOG.md

@@ -12,4 +12,9 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
   opencode agent definitions, rust crate manifest (lib only, no
   dependencies yet), MIT OR Apache-2.0 licensing. The russh pin, the
   capability feature graph, and the channel-type mapping table are
-  phase 0 research output (family ADR-003, OQ-08 remaining scope).
+  phase 0 research output (family ADR-003, OQ-08 remaining scope).
+- Phase 0 research set under `docs/research/`: `vision.md` (scope
+  questions), `russh.md` (0.64.1-era inventory + pin considerations),
+  `auth-bridge.md` (fingerprint → identity server path; vault-backed
+  client keys), `mapping-table.md` (channel type/request → family seam
+  + feature), `pocs.md` (POC-1..3 plan — documented, not yet run).