repo scaffold + AGENTS.md + Phase 0 research

- Cargo scaffold: feature gates (quinn/tcp/acme), lean tokio subset,
  placeholder lib; Cargo.lock committed with time pinned to 0.3.36 so
  rust-version = 1.85 is actually satisfiable (rcgen's default time
  resolution requires 1.88 — alknet-tls fails the same check)
- AGENTS.md adapted from alktunnels: TLS-crate conventions (behavior-
  preservation invariants, fail-closed verifier selection, one ACME
  state machine, config-construction scope boundary, no wasm target)
- .opencode/agents: implementation-specialist conventions + coordinator
  prompt template + architect deferral examples updated for alktls
- docs/research/phase-0.md: extraction inventory with verified
  invariants (line-referenced), spec-vs-code gaps (TlsError shape,
  for_tcp_tls, config-type ownership), rewrite requirements,
  OQ-TLS-01..07, MSRV verification record

Verified: cargo test, clippy -D warnings, fmt --check, doc --no-deps,
test --all-features, rustup run 1.85 cargo check

Cargo.toml

@@ -0,0 +1,43 @@
+[package]
+name = "alktls"
+version = "0.1.0"
+edition = "2021"
+rust-version = "1.85"
+license = "MIT OR Apache-2.0"
+description = "Shared TLS setup types: server and client rustls configs, cert resolvers, verifiers, and ACME state-machine wiring, transport-agnostic and shareable across transports."
+repository = "https://git.alk.dev/alkdev/alktls"
+keywords = ["tls", "rustls", "acme", "quinn", "network"]
+categories = ["network-programming", "cryptography", "asynchronous"]
+exclude = [".opencode/", "AGENTS.md", "docs/reviews/", "docs/research/", "docs/plans/", "docs/sdd_process.md"]
+
+[lib]
+name = "alktls"
+
+[features]
+default = ["quinn"]
+quinn = ["dep:quinn"]
+tcp = ["dep:tokio-rustls"]
+acme = ["dep:rustls-acme"]
+
+[dependencies]
+tokio = { version = "1", default-features = false, features = ["rt", "sync", "macros"] }
+rustls = { version = "0.23", features = ["aws_lc_rs"] }
+rustls-pki-types = "1"
+rustls-pemfile = "2"
+rustls-native-certs = "0.8"
+webpki-roots = "0.26"
+rcgen = "0.13"
+ed25519-dalek = "2"
+sha2 = "0.10"
+tracing = "0.1"
+thiserror = "2"
+
+futures = { version = "0.3", optional = true }
+quinn = { version = "0.11", optional = true }
+tokio-rustls = { version = "0.26", optional = true }
+rustls-acme = { version = "0.12", optional = true, features = ["aws-lc-rs"] }
+
+[dev-dependencies]
+tokio = { version = "1", features = ["full", "test-util", "macros"] }
+tempfile = "3"
+hex = "0.4"