crate-init: crate skeleton — module map, feature gates, TlsError, re-export block deferred per port

- src/lib.rs: crate docs, ADR-002 TlsError verbatim (six variants,
  #[non_exhaustive], typed #[source] chains), module declarations,
  compile-assertion tests for the enum + noq-gated NoqWrap
- seven module files with doc headers only (ports land per task)
- Cargo.toml verified against ADR-003 verbatim (no edits needed)
- deviation: VerifierBuild source is rustls::client::VerifierBuilderError
  (rustls::webpki is private at pinned 0.23.44; same type, public path)

Verification: cargo build/test (default, noq, tcp, acme, all-features),
clippy -D warnings, fmt --check, doc --no-deps — all green

tasks/crate-init.md

@@ -1,7 +1,7 @@
 ---
 id: crate-init
 name: Crate skeleton — module files, feature gates, error type, re-exports
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -77,7 +77,59 @@ land now so subsequent tasks are additive, not structural.
 > Agent fills this during implementation. Document any decisions,
 > deviations from architecture, or relevant context discovered.
 
+### Decisions / deviations
+
+1. **`VerifierBuild` source path: `rustls::client::VerifierBuilderError`,
+   not `rustls::webpki::VerifierBuilderError`.** The ADR-002 sketch used
+   the `rustls::webpki` path, but at the pinned rustls 0.23.44 that
+   module is private — the type is re-exported publicly at
+   `rustls::client` (verified in the 0.23.44 source: `mod webpki;` +
+   `pub use crate::webpki::{VerifierBuilderError, ...}` inside
+   `pub mod client`). Same type, public path; noted in the variant's
+   doc comment. ADR-002 needs a one-line amendment (recorded for the
+   review-impl docs-sync pass).
+2. **Re-export block deferred per module.** `lib.rs` carries the module
+   declarations now; the `pub use` block lands incrementally with each
+   port task (a re-export of a not-yet-ported type cannot compile, and
+   every intermediate commit must stay green). The final shape is
+   ADR-006's map + overview.md's surface; port-client (the last module
+   port) completes it.
+3. **The `noq`-gated compile assertion** cannot construct
+   `NoInitialCipherSuite` from outside noq-proto (private field), so the
+   test is an existence proof via `matches!` on `Option<TlsError>` —
+   compiles only when the variant + its `#[from]` source exist.
+4. **`Cargo.toml` unchanged** — the scaffold's TOML already matched
+   ADR-003's block exactly (features `default = []` / `noq` / `tcp` /
+   `acme`; `noq` with `default-features = false, features = ["rustls"]`).
+   Verified against ADR-003 line-by-line; no edits needed.
+
 ## Summary
 
 > Agent fills this on completion. Brief description of what was
-> implemented, files changed, and any follow-up needed.
+> implemented, files changed, and any follow-up needed.
+
+### What landed
+
+- `src/lib.rs`: crate docs + the ADR-002 `TlsError` verbatim (six
+  variants, `#[non_exhaustive]`, `#[source]` chains; `NoqWrap`
+  noq-gated) + module declarations + a compile-assertion test for the
+  enum (`#[from]` conversions + `AcmeConfig` display) and the noq-gated
+  `NoqWrap` existence test.
+- The seven module files (`identity`, `credentials`, `fingerprint`,
+  `server`, `client`, `pem`, `signing`) with `//!` doc headers only —
+  no bodies, per "what does NOT land here".
+- Feature matrix verified: default, `noq`, `tcp`, `acme`,
+  `--all-features`.
+
+### Verification
+
+- `cargo build` (default) ✓; `cargo test` ✓ (1 test);
+  `cargo test --features noq` ✓ (2 tests); `cargo check --features
+  tcp|acme` ✓; `cargo test --all-features` ✓; `cargo clippy
+  --all-targets --all-features -- -D warnings` ✓; `cargo fmt --check` ✓;
+  `cargo doc --no-deps` ✓.
+
+### Follow-up
+
+- ADR-002 amendment note for the `VerifierBuilderError` path
+  (review-impl docs sync).