…::spec (#595)

* refactor(hmac): fold core-hmac-spec into uselesskey-hmac::srp::spec

Inverts the dep direction between `uselesskey-hmac` and
`uselesskey-core-hmac-spec`. `HmacSpec`, its impl block, and its inline
tests now live in `crates/uselesskey-hmac/src/srp/spec.rs`;
`uselesskey-core-hmac-spec` becomes a thin re-export shim re-exporting
`uselesskey_hmac::srp::spec::*` to preserve the v0.7.x public-internal
surface for downstream pinners.

This matches the v0.7.0 fold pattern established for `core-cache`,
`core-id`, `core-hash`, `core-factory`, `token-spec`, etc. (#565-#570
and follow-ups) where the owner fixture crate took canonical ownership
and the previously-published microcrate became a compatibility shim.

Mechanical changes:

- New `crates/uselesskey-hmac/src/srp/{mod.rs,spec.rs}` carry the
  `HmacSpec` enum + helpers + inline `#[cfg(test)] mod tests` block.
- `crates/uselesskey-hmac/src/spec.rs` and `lib.rs` now re-export from
  `srp::spec`; the public `uselesskey_hmac::HmacSpec` path is unchanged.
- `uselesskey-hmac/Cargo.toml` drops the dep on
  `uselesskey-core-hmac-spec`.
- `uselesskey-core-hmac-spec/src/lib.rs` is now `pub use
  uselesskey_hmac::srp::spec::*;`. Its Cargo.toml adds
  `uselesskey-hmac.workspace = true` and updates the description.
- `xtask::PUBLISH_CRATES` and `xtask::plan::dependents()` move
  `uselesskey-core-hmac-spec` to the post-`uselesskey-hmac` position,
  matching `uselesskey-token-spec` after the token fold.
- `docs/explanation/architecture.md`, `docs/metadata/workspace-docs.json`,
  and the regenerated `docs/reference/support-matrix.md` describe the
  crate as a compatibility shim.

The shim's integration / mutant_killers / prop / snapshot tests are
unchanged and continue to pass via the new re-export. `stable_bytes()`
values, JOSE alg names, byte lengths, and Debug output are identical
to v0.7.1; no derivation-stability impact.

This is PR-1 of the v0.8.0 SRP collapse lane. The shim crate stays
published for v0.7.x compat and is scheduled for removal in PR-4.

* refactor(hmac): bump uselesskey-hmac and core-hmac-spec to 0.7.2

The fold introduces a new public `uselesskey_hmac::srp::spec` module
which the `uselesskey-core-hmac-spec` shim now re-exports. The
published v0.7.1 of `uselesskey-hmac` does not have this path, so
`cargo publish --dry-run -p uselesskey-core-hmac-spec` would resolve
its dep against registry v0.7.1 and fail with `E0433: cannot find
'srp' in 'uselesskey_hmac'`.

Bump both crates to v0.7.2 so the live publish lane resolves the shim
against the new (v0.7.2) `uselesskey-hmac` that ships in the same wave.
Downstream consumers (`uselesskey`, `uselesskey-jsonwebtoken`,
`uselesskey-jose-openid`, `uselesskey-rustcrypto`, `uselesskey-cli`,
`uselesskey-interop-tests`) keep their existing `version = "0.7.1"`
constraint — cargo treats it as `^0.7.1`, which accepts v0.7.2.

`publish-check` once this PR lands: the v0.7.2 publish of
`uselesskey-hmac` precedes the v0.7.2 publish of
`uselesskey-core-hmac-spec` (already enforced by PUBLISH_CRATES
topological order), so the shim's dry-run finds the new `srp::spec`
path on the registry.

…::srp::pki (#598)

* refactor(rustls): fold core-rustls-pki into uselesskey-rustls::srp::pki

Inverts the dep direction between `uselesskey-rustls` and
`uselesskey-core-rustls-pki`. The `RustlsPrivateKeyExt`,
`RustlsCertExt`, and `RustlsChainExt` traits and their impls for
RSA, ECDSA, Ed25519, and X.509 fixture types now live in
`crates/uselesskey-rustls/src/srp/pki.rs`;
`uselesskey-core-rustls-pki` becomes a thin re-export shim
re-exporting `uselesskey_rustls::srp::pki::*` to preserve the
v0.7.x public-internal surface for downstream pinners.

This matches the v0.7.0 fold pattern established for `core-cache`,
`core-id`, `core-hash`, `core-factory`, `token-spec`, etc. (#565-#570
and follow-ups) and the v0.8.0 hmac-spec fold (#595) where the owner
crate took canonical ownership and the previously-published microcrate
became a compatibility shim.

Mechanical changes:

- New `crates/uselesskey-rustls/src/srp/{mod.rs,pki.rs}` carry the
  three extension traits, all impl blocks, and the inline
  `#[cfg(test)] mod tests` blocks.
- `crates/uselesskey-rustls/src/lib.rs` declares `pub mod srp` (doc-
  hidden) and re-exports the pki traits at the top level. The public
  `uselesskey_rustls::{RustlsPrivateKeyExt, RustlsCertExt,
  RustlsChainExt}` path is unchanged.
- `uselesskey-rustls/Cargo.toml` drops the dep on
  `uselesskey-core-rustls-pki` and gains a direct `rustls-pki-types`
  dep; per-key-type feature flags drop the
  `uselesskey-core-rustls-pki/*` re-export legs.
- `uselesskey-core-rustls-pki/src/lib.rs` is now a thin shim:
  `pub use uselesskey_rustls::srp::pki::*`. Its Cargo.toml drops the
  direct rustls-pki-types and key-type deps, adds
  `uselesskey-rustls.workspace = true`, and routes its features to
  `uselesskey-rustls/*`.
- The shim's `tests/{integration,deterministic,snapshots_rustls_pki}.rs`
  and snapshot files move under `crates/uselesskey-rustls/tests/`.
  Snapshot file names and contents are preserved (same deterministic
  seed `uselesskey-rustls-pki-snap-seed-v1`); only the Rust import
  paths are rewritten from `uselesskey_core_rustls_pki::*` to
  `uselesskey_rustls::*`.
- `xtask::PUBLISH_CRATES` moves `uselesskey-core-rustls-pki` to a
  post-`uselesskey-rustls` slot under a "rustls compatibility shim"
  comment, matching `uselesskey-core-hmac-spec` after the hmac fold.
- `xtask::plan::dependents()` makes `uselesskey-core-rustls-pki` a
  leaf and adds it as a `uselesskey-rustls` dependent (so a rustls
  source change still triggers a shim rebuild).
- `docs/explanation/architecture.md`,
  `docs/metadata/workspace-docs.json`, and
  `docs/reference/support-matrix.md` describe the crate as a
  compatibility shim.

Both `uselesskey-rustls` and `uselesskey-core-rustls-pki` bump to
0.7.2 so the shim's re-export of `uselesskey_rustls::srp::pki`
resolves against a registry version that ships the new path:
`cargo publish --dry-run -p uselesskey-core-rustls-pki` would otherwise
resolve against the published v0.7.1 of `uselesskey-rustls`, which
does not have `srp::pki`, and fail with `E0432: unresolved imports`.

Downstream consumers (`uselesskey`, `uselesskey-bdd-steps`,
`uselesskey-interop-tests`) keep their existing `version = "0.7.1"`
constraint — cargo treats it as `^0.7.1`, which accepts v0.7.2.

This is PR-2 of the v0.8.0 SRP collapse lane. The shim crate stays
published for v0.7.x compat and is scheduled for removal in a later
v0.8.0 PR.

* docs(rustls): bump version snippets to 0.7.2 for the rustls fold

The `uselesskey-rustls` v0.7.2 bump (PR-2 of the v0.8.0 SRP collapse
lane) outpaces the workspace-wide `release_version: "0.7.1"` field
in `docs/metadata/workspace-docs.json`, which docs-sync uses to render
all dependency snippets uniformly. The preflight `doc-versions` lane
checks each rendered snippet against the per-crate
`Cargo.toml` version, so a uniform `0.7.1` snippet for
`uselesskey-rustls` would fail against its bumped manifest.

Add an optional `version` override to `SnippetDependency`, route it
through `render_single_dependency_snippet`, and set the override to
`"0.7.2"` on the `uselesskey-rustls` snippet entry. The other deps
in the same snippets continue to render against the workspace-wide
`release_version` field. Regenerate the README and how-to dependency
blocks accordingly.

This same pattern can be reused on subsequent SRP-fold PRs where a
single fold-target crate bumps ahead of the rest of the workspace.

* xtask(docs-sync): add per-dep version override test

Adds a unit test exercising the new optional `version` field on
`SnippetDependency`, locking in the SRP-fold pattern where a single
crate has been bumped ahead of the workspace-wide `release_version`
(e.g. v0.8.0 SRP folds where one crate goes to 0.7.2 while the rest
of the workspace stays on 0.7.1) so future regressions on the
override path are caught in `cargo test -p xtask`.

Also fixes the existing snippet-rendering test to provide the new
`version: None` field after the struct literal added the field.