generation 4: integration suite — seam round-trips + invariant pins

tests/server_seams.rs:
- TlsServerConfig::new per identity variant → rustls_config() +
  for_tcp_tls (tcp) + for_noq (noq); ALPN + max_early_data_size=u32::MAX
  asserted per path; Acme-no-feature → AcmeConfig cell

tests/client_seams.rs:
- TlsClientConfig::new per credentials cell → into_rustls_config +
  for_noq; enable_early_data=true + single-value ALPN pinned

tests/invariant_pins.rs:
- nine-scheme exact-list pin (vec equality, order included)
- verifier-selection + client-auth presentation matrices via public
  API (Debug probe for the pub(super) verifier, direct resolver
  introspection); root-store fallback non-empty

tests/acme_lifecycle.rs (#![cfg(feature = acme)]):
- spawn-and-return, acme-tls/1 in ALPN, resolver wiring, 0-RTT on the
  ACME branch; blackhole + staging URLs — zero network I/O

Verification: all five feature combos green (default 68+13, noq 72+16,
tcp 71+13, acme 68+11, all-features 75+17), clippy -D warnings,
fmt --check, doc --no-deps

tests/client_seams.rs

@@ -0,0 +1,76 @@
+//! Client seam round-trips: [`TlsClientConfig::new`] per credentials cell
+//! → `into_rustls_config()` (and `for_noq()` under the `noq` feature);
+//! `enable_early_data == true` pinned (the client half of the 0-RTT
+//! invariant, ADR-001); the config carries a single-value ALPN list.
+
+use alktls::{
+    ConnectionCredentials, Ed25519SecretKey, RemoteIdentity, TlsClientConfig, TlsIdentity,
+};
+
+fn pinned_credentials() -> ConnectionCredentials {
+    ConnectionCredentials::new()
+        .with_local_identity(TlsIdentity::RawKey(Ed25519SecretKey::generate()))
+        .with_remote_identity(RemoteIdentity {
+            fingerprint: "ed25519:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+                .to_string(),
+        })
+}
+
+fn ca_credentials() -> ConnectionCredentials {
+    ConnectionCredentials::new()
+        .with_local_identity(TlsIdentity::RawKey(Ed25519SecretKey::generate()))
+}
+
+fn assert_client_seam(config: rustls::ClientConfig, alpn: &[u8]) {
+    assert!(
+        config.enable_early_data,
+        "enable_early_data must be true on every client config (the client half of the 0-RTT \
+         invariant, ADR-001)"
+    );
+    assert_eq!(
+        config.alpn_protocols,
+        vec![alpn.to_vec()],
+        "the client config carries a single-value ALPN list"
+    );
+}
+
+#[test]
+fn pinned_cell_into_rustls_config_round_trip() {
+    let config = TlsClientConfig::new(&pinned_credentials(), b"alk/call")
+        .expect("pinned cell must construct");
+    assert_client_seam(config.into_rustls_config(), b"alk/call");
+}
+
+#[test]
+fn ca_cell_into_rustls_config_round_trip() {
+    let config =
+        TlsClientConfig::new(&ca_credentials(), b"alk/call").expect("CA cell must construct");
+    assert_client_seam(config.into_rustls_config(), b"alk/call");
+}
+
+#[test]
+fn empty_credentials_cell_into_rustls_config_round_trip() {
+    let config = TlsClientConfig::new(&ConnectionCredentials::new(), b"alk/call")
+        .expect("empty cell (no local identity, no pin) must construct — the public-X.509 state");
+    assert_client_seam(config.into_rustls_config(), b"alk/call");
+}
+
+#[cfg(feature = "noq")]
+#[test]
+fn pinned_cell_for_noq_round_trip() {
+    let config = TlsClientConfig::new(&pinned_credentials(), b"alk/call")
+        .expect("pinned cell must construct");
+    let noq_config = config
+        .for_noq()
+        .expect("for_noq must wrap the rustls config for QUIC");
+    let _ = noq_config;
+}
+
+#[cfg(feature = "noq")]
+#[test]
+fn ca_cell_for_noq_round_trip() {
+    let config =
+        TlsClientConfig::new(&ca_credentials(), b"alk/call").expect("CA cell must construct");
+    let noq_config = config.for_noq().expect("for_noq must wrap for QUIC");
+    let _ = noq_config;
+}