Summary

• Move TokenSpec, base62 helpers, token-shape generation, and NegativeToken under uselesskey-token::srp::* while preserving the supported uselesskey-token root exports.
• Convert uselesskey-token-spec, uselesskey-core-base62, uselesskey-core-token-shape, and uselesskey-core-token into published-internal compatibility shims.
• Update publish/mutant ordering, PR impact planning, public-surface docs, support metadata, changelog, and the token-only facade test gate.
• Add mutation-proof tests for the moved base62 acceptance boundary and JWT negative-shape helpers after hosted xtask pr exposed missed mutants.

Validation

• cargo test -p uselesskey-token --all-features
• cargo test -p uselesskey-token-spec -p uselesskey-core-base62 -p uselesskey-core-token-shape -p uselesskey-core-token
• cargo test -p uselesskey --features token
• cargo test -p uselesskey-cli --all-features
• cargo test -p uselesskey-bdd-steps --no-default-features --features uk-core-token-shape
• cargo check --manifest-path fuzz/Cargo.toml --bins (passed; unrelated fuzz lockfile blake3/cpufeatures churn was not kept in this PR)
• cargo xtask examples-smoke
• cargo xtask docs-sync --check
• cargo xtask public-surface
• cargo xtask no-blob
• cargo xtask publish-preflight --allow-dirty
• cargo xtask lint-fix --check
• cargo test -p xtask
• cargo mutants --all-features --manifest-path crates/uselesskey-token/Cargo.toml
• git diff --check

Review Notes

• A review agent found no blocking issues. It flagged hidden srp paths being presented as user-facing canonical imports; the shim README and support-matrix wording now points users to supported crate paths while leaving SRP modules as the internal ownership target.
• First hosted CI run failed only in mutation testing for moved token helper surfaces; the second commit adds focused coverage and the targeted local mutation lane is clean.