fix: address code review #001 findings (M1, M2, L2, L4, L5, N1-N3, N5)

- M1: TtySession now handles the negotiation-rejection error frame.
  from_halves peeks the first response byte (ADR-052 §5 disambiguation)
  and returns NegotiationRejected on a 0x00-prefixed error frame;
  ChunkReader gains peek_stream_type/read_chunk_after_peek.
- M2: wait() now surfaces MalformedExitChunk instead of collapsing it
  to NoExitChunk. The exit watch channel carries a cloneable
  ExitOutcome enum; MalformedExitChunk carries a String.
- L2: add EmittingBackend + recv_stdout_and_stderr_route_backend_data
  test covering the consumer read-pump stdout/stderr routing.
- L4: MockBackend/MockControl/MockStdinSink are now #[cfg(test)]
  pub(crate), removing them from the public API.
- L5: cargo fmt (the BAST drift test was unformatted).
- N1: fix all 9 rustdoc intra-doc links.
- N2: fix stale doc paths (crates/tty/ and docs/research/).
- N3: amend AGENTS.md §14 to accurately describe the local module's
  libc::kill unsafe blocks.
- N5: consolidate nanos_seed into tests/common/mod.rs.

Verification: cargo test (84), cargo test --all-features (107),
clippy clean (native + wasm), fmt clean, doc clean, wasm check clean.
Coverage: session.rs 79.71% -> 87.43%, total 90.74% -> 91.47%.

tests/pipe.rs

@@ -18,7 +18,7 @@ use std::time::Duration;
 
 use alktty::local::LocalTtyBackend;
 use alktty::wire::STREAM_STDOUT;
-use common::{negotiate_pipe_json, spawn_session};
+use common::{nanos_seed, negotiate_pipe_json, spawn_session};
 
 /// 9. Happy path (echo): negotiate `{backend:"local", tty:null,
 /// cmd:["echo","hello"]}`, read stdout chunks, assert "hello", exit 0.
@@ -214,11 +214,3 @@ async fn pipe_echo_emits_stdout_chunk_then_sentinel() {
     );
     let _ = server.await;
 }
-
-fn nanos_seed() -> u64 {
-    use std::time::{SystemTime, UNIX_EPOCH};
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map(|d| d.as_nanos() as u64)
-        .unwrap_or(0)
-}