repo scaffold + AGENTS.md + Phase 0 research

- Cargo scaffold: feature gates (quinn/tcp/acme), lean tokio subset,
  placeholder lib; Cargo.lock committed with time pinned to 0.3.36 so
  rust-version = 1.85 is actually satisfiable (rcgen's default time
  resolution requires 1.88 — alknet-tls fails the same check)
- AGENTS.md adapted from alktunnels: TLS-crate conventions (behavior-
  preservation invariants, fail-closed verifier selection, one ACME
  state machine, config-construction scope boundary, no wasm target)
- .opencode/agents: implementation-specialist conventions + coordinator
  prompt template + architect deferral examples updated for alktls
- docs/research/phase-0.md: extraction inventory with verified
  invariants (line-referenced), spec-vs-code gaps (TlsError shape,
  for_tcp_tls, config-type ownership), rewrite requirements,
  OQ-TLS-01..07, MSRV verification record

Verified: cargo test, clippy -D warnings, fmt --check, doc --no-deps,
test --all-features, rustup run 1.85 cargo check

.opencode/agents/architect.md

@@ -329,7 +329,7 @@ A decision should be `deferred(scope)` when:
 - The use case isn't concrete (e.g., "we don't know what the agent crate
   will need from the call protocol")
 - The options depend on something that doesn't exist yet (e.g.,
-  "depends on the alknet-http crate spec")
+  "depends on the alknet rewrite's dial-seam shape")
 - The trade-off requires data that can only come from implementation
   (e.g., "need performance benchmarks to choose between X and Y")
 - The decision is genuinely not needed for the current scope (e.g., "the
@@ -373,10 +373,10 @@ A decision should be `deferred(unclear)` when:
    (implies it's decided).
 2. **State the blocking condition** (`deferred(scope)`) or
    **investigation target** (`deferred(unclear)`) — what specific thing
-   would unblock this? Be concrete: "blocked on: alknet-agent crate spec
-   exists" or "investigation: work through 2+ example outbound-dial use
-   cases (hub→worker, worker→hub) to see how verifier-selection +
-   provider + connector compose."
+   would unblock this? Be concrete: "blocked on: the alknet rewrite's
+   dial-seam shape exists" or "investigation: work through 2+ example
+   outbound-dial use cases (hub→worker, worker→hub) to see how
+   verifier-selection + provider + connector compose."
 3. **State the impacts** — what does this block downstream? Be
    specific: "blocks the first hub deployment because the hub dials
    workers" not "blocks the hub crate." This is the triage signal that