fix: address code review #001 findings (M1, M2, L2, L4, L5, N1-N3, N5)

- M1: TtySession now handles the negotiation-rejection error frame.
  from_halves peeks the first response byte (ADR-052 §5 disambiguation)
  and returns NegotiationRejected on a 0x00-prefixed error frame;
  ChunkReader gains peek_stream_type/read_chunk_after_peek.
- M2: wait() now surfaces MalformedExitChunk instead of collapsing it
  to NoExitChunk. The exit watch channel carries a cloneable
  ExitOutcome enum; MalformedExitChunk carries a String.
- L2: add EmittingBackend + recv_stdout_and_stderr_route_backend_data
  test covering the consumer read-pump stdout/stderr routing.
- L4: MockBackend/MockControl/MockStdinSink are now #[cfg(test)]
  pub(crate), removing them from the public API.
- L5: cargo fmt (the BAST drift test was unformatted).
- N1: fix all 9 rustdoc intra-doc links.
- N2: fix stale doc paths (crates/tty/ and docs/research/).
- N3: amend AGENTS.md §14 to accurately describe the local module's
  libc::kill unsafe blocks.
- N5: consolidate nanos_seed into tests/common/mod.rs.

Verification: cargo test (84), cargo test --all-features (107),
clippy clean (native + wasm), fmt clean, doc clean, wasm check clean.
Coverage: session.rs 79.71% -> 87.43%, total 90.74% -> 91.47%.

src/channels.rs

@@ -9,7 +9,7 @@
 //! on the per-connection overlay registry. When a consumer (a
 //! [`crate::session::TtySession`] or any `ChannelClient` caller)
 //! invokes `channels/tty/sub`, the alkcall channels wrapper does
-//! `check_open` → `open_channel` → spawn the [`TtyOpenHandler`] →
+//! `check_open` → `open_channel` → spawn the `TtyOpenHandler` →
 //! respond with `{ channel_id }`. The `TtyOpenHandler` receives the
 //! channel's `Connection` (data-plane ALPN `alk/tty`), calls
 //! `accept_bi()` to get the channel's `BiStream`, and runs
@@ -49,8 +49,8 @@ use crate::backend::TtyBackend;
 /// the op is `sub` (subscribe), not `pub` (publish).
 pub const OP_TTY_OPEN: &str = "channels/tty/sub";
 
-/// The data-plane ALPN the channel carries. Matches the constant in
-/// [`crate::adapter::TtyAdapter::alpn`].
+/// The data-plane ALPN the channel carries. Matches the ALPN returned
+/// by [`crate::adapter::TtyAdapter`]'s `alpn()`.
 pub const TTY_ALPN: &str = "alk/tty";
 
 /// Register the `channels/tty/sub` open op on a per-connection
@@ -67,7 +67,7 @@ pub const TTY_ALPN: &str = "alk/tty";
 /// the `tty:open` scope gate, and a permissive input schema (the
 /// `NegotiateRequest` shape — JSON, validated by the
 /// `drive_session` negotiation reader). It then wraps the
-/// [`TtyOpenHandler`] factory and calls
+/// `TtyOpenHandler` factory and calls
 /// [`ChannelCore::register_openable`].
 ///
 /// `backends` is the same backend map the direct-ALPN `TtyAdapter`