…::srp::pki (#598)

* refactor(rustls): fold core-rustls-pki into uselesskey-rustls::srp::pki

Inverts the dep direction between `uselesskey-rustls` and
`uselesskey-core-rustls-pki`. The `RustlsPrivateKeyExt`,
`RustlsCertExt`, and `RustlsChainExt` traits and their impls for
RSA, ECDSA, Ed25519, and X.509 fixture types now live in
`crates/uselesskey-rustls/src/srp/pki.rs`;
`uselesskey-core-rustls-pki` becomes a thin re-export shim
re-exporting `uselesskey_rustls::srp::pki::*` to preserve the
v0.7.x public-internal surface for downstream pinners.

This matches the v0.7.0 fold pattern established for `core-cache`,
`core-id`, `core-hash`, `core-factory`, `token-spec`, etc. (#565-#570
and follow-ups) and the v0.8.0 hmac-spec fold (#595) where the owner
crate took canonical ownership and the previously-published microcrate
became a compatibility shim.

Mechanical changes:

- New `crates/uselesskey-rustls/src/srp/{mod.rs,pki.rs}` carry the
  three extension traits, all impl blocks, and the inline
  `#[cfg(test)] mod tests` blocks.
- `crates/uselesskey-rustls/src/lib.rs` declares `pub mod srp` (doc-
  hidden) and re-exports the pki traits at the top level. The public
  `uselesskey_rustls::{RustlsPrivateKeyExt, RustlsCertExt,
  RustlsChainExt}` path is unchanged.
- `uselesskey-rustls/Cargo.toml` drops the dep on
  `uselesskey-core-rustls-pki` and gains a direct `rustls-pki-types`
  dep; per-key-type feature flags drop the
  `uselesskey-core-rustls-pki/*` re-export legs.
- `uselesskey-core-rustls-pki/src/lib.rs` is now a thin shim:
  `pub use uselesskey_rustls::srp::pki::*`. Its Cargo.toml drops the
  direct rustls-pki-types and key-type deps, adds
  `uselesskey-rustls.workspace = true`, and routes its features to
  `uselesskey-rustls/*`.
- The shim's `tests/{integration,deterministic,snapshots_rustls_pki}.rs`
  and snapshot files move under `crates/uselesskey-rustls/tests/`.
  Snapshot file names and contents are preserved (same deterministic
  seed `uselesskey-rustls-pki-snap-seed-v1`); only the Rust import
  paths are rewritten from `uselesskey_core_rustls_pki::*` to
  `uselesskey_rustls::*`.
- `xtask::PUBLISH_CRATES` moves `uselesskey-core-rustls-pki` to a
  post-`uselesskey-rustls` slot under a "rustls compatibility shim"
  comment, matching `uselesskey-core-hmac-spec` after the hmac fold.
- `xtask::plan::dependents()` makes `uselesskey-core-rustls-pki` a
  leaf and adds it as a `uselesskey-rustls` dependent (so a rustls
  source change still triggers a shim rebuild).
- `docs/explanation/architecture.md`,
  `docs/metadata/workspace-docs.json`, and
  `docs/reference/support-matrix.md` describe the crate as a
  compatibility shim.

Both `uselesskey-rustls` and `uselesskey-core-rustls-pki` bump to
0.7.2 so the shim's re-export of `uselesskey_rustls::srp::pki`
resolves against a registry version that ships the new path:
`cargo publish --dry-run -p uselesskey-core-rustls-pki` would otherwise
resolve against the published v0.7.1 of `uselesskey-rustls`, which
does not have `srp::pki`, and fail with `E0432: unresolved imports`.

Downstream consumers (`uselesskey`, `uselesskey-bdd-steps`,
`uselesskey-interop-tests`) keep their existing `version = "0.7.1"`
constraint — cargo treats it as `^0.7.1`, which accepts v0.7.2.

This is PR-2 of the v0.8.0 SRP collapse lane. The shim crate stays
published for v0.7.x compat and is scheduled for removal in a later
v0.8.0 PR.

* docs(rustls): bump version snippets to 0.7.2 for the rustls fold

The `uselesskey-rustls` v0.7.2 bump (PR-2 of the v0.8.0 SRP collapse
lane) outpaces the workspace-wide `release_version: "0.7.1"` field
in `docs/metadata/workspace-docs.json`, which docs-sync uses to render
all dependency snippets uniformly. The preflight `doc-versions` lane
checks each rendered snippet against the per-crate
`Cargo.toml` version, so a uniform `0.7.1` snippet for
`uselesskey-rustls` would fail against its bumped manifest.

Add an optional `version` override to `SnippetDependency`, route it
through `render_single_dependency_snippet`, and set the override to
`"0.7.2"` on the `uselesskey-rustls` snippet entry. The other deps
in the same snippets continue to render against the workspace-wide
`release_version` field. Regenerate the README and how-to dependency
blocks accordingly.

This same pattern can be reused on subsequent SRP-fold PRs where a
single fold-target crate bumps ahead of the rest of the workspace.

* xtask(docs-sync): add per-dep version override test

Adds a unit test exercising the new optional `version` field on
`SnippetDependency`, locking in the SRP-fold pattern where a single
crate has been bumped ahead of the workspace-wide `release_version`
(e.g. v0.8.0 SRP folds where one crate goes to 0.7.2 while the rest
of the workspace stays on 0.7.1) so future regressions on the
override path are caught in `cargo test -p xtask`.

Also fixes the existing snippet-rendering test to provide the new
`version: None` field after the struct literal added the field.

…::native

Inverts the dep direction between `uselesskey-pgp` and
`uselesskey-pgp-native`. The `PgpNativeExt` trait and its impls now
live in `crates/uselesskey-pgp/src/native.rs`, gated behind a new
`native` Cargo feature on `uselesskey-pgp`. `uselesskey-pgp-native`
becomes a thin re-export shim re-exporting `uselesskey_pgp::native::*`
to preserve the v0.7.x public-internal surface for downstream pinners.

This matches the v0.7.0 fold pattern established for `core-cache`,
`core-id`, `core-hash`, `core-factory`, `token-spec`, etc. and the
v0.8.0 hmac-spec fold (#595) where the owner fixture crate took
canonical ownership and the previously-published microcrate became a
compatibility shim.

Mechanical changes:

- New `crates/uselesskey-pgp/src/native.rs` carries `PgpNativeExt`,
  the impl block on `PgpKeyPair`, and the inline `#[cfg(test)] mod
  tests` block.
- `crates/uselesskey-pgp/src/lib.rs` declares
  `#[cfg(feature = "native")] pub mod native;` and re-exports
  `PgpNativeExt` at the top level under the same gate.
- `uselesskey-pgp/Cargo.toml` adds a `native` Cargo feature
  (`native = []`); the `pgp` dep is already a required workspace
  dep for keygen, so no new dep surface is added. The `pgp` 0.19
  pin moves into `[workspace.dependencies]` so the two crates share
  the same version line.
- `uselesskey-pgp-native/Cargo.toml` drops its direct `pgp = ...`
  dep, adds `uselesskey-pgp.workspace = true` with
  `features = ["native"]`, and routes its `pgp-native` feature to a
  no-op marker (the surface is unconditionally re-exported because
  `uselesskey-pgp` is now a hard dep with `native` already enabled).
  `pgp` remains as a dev-dep for the integration test and example.
- `uselesskey-pgp-native/src/lib.rs` is now a thin shim:
  `pub use uselesskey_pgp::native::*;`.
- `xtask::PUBLISH_CRATES` moves `uselesskey-pgp-native` to a
  post-`uselesskey-pgp` slot under a "PGP compatibility shim"
  comment, matching `uselesskey-core-hmac-spec` after the hmac fold.
- `xtask::plan::dependents()` makes `uselesskey-pgp-native` a leaf
  and adds it as a `uselesskey-pgp` dependent (so a pgp source
  change still triggers a shim rebuild). A new
  `pgp_native_change_is_isolated_to_shim` test mirrors the
  `core_hmac_spec_change_is_isolated_to_shim` shape.
- `docs/explanation/architecture.md`,
  `docs/metadata/workspace-docs.json`, and
  `docs/reference/support-matrix.md` describe the crate as a
  compatibility shim.

Both `uselesskey-pgp` and `uselesskey-pgp-native` bump to 0.7.2 so
the shim's re-export of `uselesskey_pgp::native` resolves against a
registry version that ships the new path: `cargo publish --dry-run
-p uselesskey-pgp-native` would otherwise resolve against the
published v0.7.1 of `uselesskey-pgp`, which does not have `native`,
and fail with `E0432: unresolved imports`.

Downstream consumers (`uselesskey`, `uselesskey-interop-tests`) keep
their existing `version = "0.7.1"` constraint — cargo treats it as
`^0.7.1`, which accepts v0.7.2.

This is PR-3 of the v0.8.0 SRP collapse lane. The shim crate stays
published for v0.7.x compat and is scheduled for removal in PR-4.

…::native (#599)

* refactor(pgp): fold uselesskey-pgp-native content into uselesskey-pgp::native

Inverts the dep direction between `uselesskey-pgp` and
`uselesskey-pgp-native`. The `PgpNativeExt` trait and its impls now
live in `crates/uselesskey-pgp/src/native.rs`, gated behind a new
`native` Cargo feature on `uselesskey-pgp`. `uselesskey-pgp-native`
becomes a thin re-export shim re-exporting `uselesskey_pgp::native::*`
to preserve the v0.7.x public-internal surface for downstream pinners.

This matches the v0.7.0 fold pattern established for `core-cache`,
`core-id`, `core-hash`, `core-factory`, `token-spec`, etc. and the
v0.8.0 hmac-spec fold (#595) where the owner fixture crate took
canonical ownership and the previously-published microcrate became a
compatibility shim.

Mechanical changes:

- New `crates/uselesskey-pgp/src/native.rs` carries `PgpNativeExt`,
  the impl block on `PgpKeyPair`, and the inline `#[cfg(test)] mod
  tests` block.
- `crates/uselesskey-pgp/src/lib.rs` declares
  `#[cfg(feature = "native")] pub mod native;` and re-exports
  `PgpNativeExt` at the top level under the same gate.
- `uselesskey-pgp/Cargo.toml` adds a `native` Cargo feature
  (`native = []`); the `pgp` dep is already a required workspace
  dep for keygen, so no new dep surface is added. The `pgp` 0.19
  pin moves into `[workspace.dependencies]` so the two crates share
  the same version line.
- `uselesskey-pgp-native/Cargo.toml` drops its direct `pgp = ...`
  dep, adds `uselesskey-pgp.workspace = true` with
  `features = ["native"]`, and routes its `pgp-native` feature to a
  no-op marker (the surface is unconditionally re-exported because
  `uselesskey-pgp` is now a hard dep with `native` already enabled).
  `pgp` remains as a dev-dep for the integration test and example.
- `uselesskey-pgp-native/src/lib.rs` is now a thin shim:
  `pub use uselesskey_pgp::native::*;`.
- `xtask::PUBLISH_CRATES` moves `uselesskey-pgp-native` to a
  post-`uselesskey-pgp` slot under a "PGP compatibility shim"
  comment, matching `uselesskey-core-hmac-spec` after the hmac fold.
- `xtask::plan::dependents()` makes `uselesskey-pgp-native` a leaf
  and adds it as a `uselesskey-pgp` dependent (so a pgp source
  change still triggers a shim rebuild). A new
  `pgp_native_change_is_isolated_to_shim` test mirrors the
  `core_hmac_spec_change_is_isolated_to_shim` shape.
- `docs/explanation/architecture.md`,
  `docs/metadata/workspace-docs.json`, and
  `docs/reference/support-matrix.md` describe the crate as a
  compatibility shim.

Both `uselesskey-pgp` and `uselesskey-pgp-native` bump to 0.7.2 so
the shim's re-export of `uselesskey_pgp::native` resolves against a
registry version that ships the new path: `cargo publish --dry-run
-p uselesskey-pgp-native` would otherwise resolve against the
published v0.7.1 of `uselesskey-pgp`, which does not have `native`,
and fail with `E0432: unresolved imports`.

Downstream consumers (`uselesskey`, `uselesskey-interop-tests`) keep
their existing `version = "0.7.1"` constraint — cargo treats it as
`^0.7.1`, which accepts v0.7.2.

This is PR-3 of the v0.8.0 SRP collapse lane. The shim crate stays
published for v0.7.x compat and is scheduled for removal in PR-4.

* refactor(pgp): bump pgp-native snippet to 0.7.2 with version_override

Adds an optional `version_override` field to
`DependencySnippet::dependencies[]` in `docs/metadata/workspace-docs.json`
so a single dependency in a rendered snippet can be pinned to a
post-`release_version` bump. Used here to render
`uselesskey-pgp-native = { version = "0.7.2" }` while the rest of the
snippet continues to use the `release_version` (0.7.1).

This matches the publish-preflight `doc-versions` invariant after the
pgp-native fold (#PR-3 of the v0.8.0 SRP collapse lane) bumped
`uselesskey-pgp-native` to 0.7.2 alongside `uselesskey-pgp`.

- `xtask::docs_sync::SnippetDependency` gains
  `version_override: Option<String>`; `render_single_dependency_snippet`
  prefers it when present.
- `docs/metadata/workspace-docs.json` sets the override on the
  `pgp-native adapter` snippet entry.
- Regenerated `README.md`, `crates/uselesskey/README.md`, and
  `docs/how-to/choose-features.md` via `cargo xtask docs-sync`.

Removes 29 fully-folded published-internal compatibility shim crates that
v0.7.x carried as one-minor-release re-export shells over content already
owned by the public crates' `srp::*` modules. This is PR-4 of the v0.8.0
SRP collapse lane and is a BREAKING change for downstream consumers that
pinned the shim crate names directly.

Scope (29 crates removed)

Core internals (11) -> uselesskey_core::srp::*:
- uselesskey-core-cache, -factory, -hash, -id, -seed, -sink
- uselesskey-core-keypair, -keypair-material
- uselesskey-core-negative, -negative-der, -negative-pem

JWK internals (5) -> uselesskey_jwk::srp::*:
- uselesskey-core-kid, -jwk, -jwk-builder, -jwk-shape, -jwks-order

Token internals (4) -> uselesskey_token::srp::*:
- uselesskey-core-base62, -token, -token-shape, uselesskey-token-spec

X.509 internals (5) -> uselesskey_x509::srp::*:
- uselesskey-core-x509, -x509-spec, -x509-derive,
  -x509-negative, -x509-chain-negative

Folded standalones (3):
- uselesskey-core-hmac-spec -> uselesskey_hmac::srp::spec (content moved
  in v0.7.2 via #595; shim removed here)
- uselesskey-core-rustls-pki -> uselesskey_rustls::srp::pki (content moved
  in v0.7.2 via #598; shim removed here)
- uselesskey-pgp-native -> uselesskey_pgp::native (feature = "native";
  content moved in v0.7.2 via #599; shim removed here)

Conditional duplicate (1):
- uselesskey-jose-openid was byte-equal to uselesskey_jsonwebtoken::JwtKeyExt;
  consumers should depend on uselesskey-jsonwebtoken directly.

Why

The v0.7.x line shipped each fold (#595, #598, #599 and predecessors) with
the shim crate retained as a published-internal re-export so v0.7.x
downstreams kept compiling for one minor release. v0.8.0 removes the
shims per the SRP collapse plan; crate-surface contracts at the module
boundary instead of the crate boundary. The published surface goes from
51 to 22 public + 3 workspace-internal.

Migration

Downstream consumers should:
- Replace `uselesskey-core-<x>` imports with `uselesskey_core::srp::<x>`
- Replace `uselesskey-core-jwk*` / `-kid` / `-jwks-order` with `uselesskey_jwk`
- Replace `uselesskey-token-spec` / `-core-base62` / `-core-token*` with
  `uselesskey_token` and its `srp::*` modules
- Replace `uselesskey-core-x509*` with `uselesskey_x509::srp::*`
- Replace `uselesskey-core-hmac-spec` with `uselesskey_hmac::srp::spec`
- Replace `uselesskey-core-rustls-pki` with `uselesskey_rustls::srp::pki`
- Replace `uselesskey-pgp-native` with `uselesskey-pgp` `features = ["native"]`
- Replace `uselesskey-jose-openid::JoseOpenIdKeyExt` with
  `uselesskey_jsonwebtoken::JwtKeyExt`

A full crate-to-module mapping table will land in
docs/how-to/migrate-from-v0.7.md (PR-5).

What this PR touches

- Removes 29 crate directories from `crates/`.
- Updates the workspace `Cargo.toml` `[workspace] members` and
  `[workspace.dependencies]` to drop the removed names.
- Updates `xtask` PUBLISH_CRATES, MUTANT_CRATES, dependents() map,
  `compatibility_shim_owner` callsite, `is_adapter_crate` allowlist,
  and the public-surface internal-shard guard.
- Removes the `is_adapter_crate` jose-openid / pgp-native entries.
- Removes obsolete plan.rs tests that pinned per-shim impact propagation.
- Migrates internal callers (`uselesskey-rsa/-ecdsa/-ed25519` keypair.rs,
  `uselesskey-bdd-steps`, all `fuzz/fuzz_targets/*.rs`) to canonical
  owner-crate `srp::*` paths.
- Regenerates `docs/metadata/workspace-docs.json`, the support matrix,
  and the public-surface survey.
- Resets `policy/no-panic-baseline.toml` to reflect the new module
  topology (deleted crate paths drop out; their canonical owner-crate
  paths are now the only home of the same panic-family findings).
- Notes the cleanup in `CHANGELOG.md` `[Unreleased] Removed`,
  `AGENTS.md`, `CLAUDE.md`, and `docs/explanation/architecture.md`.

Cross-refs: #595 (HmacSpec fold), #598 (rustls-pki fold), #599 (pgp-native
fold) shipped the content moves; this PR removes the now-empty shim
crates.

Validation

- `cargo check --workspace --all-targets --all-features` clean.
- `cargo test --workspace --all-features --exclude uselesskey-bdd --no-run`
  clean.
- `cargo fmt --check` clean.
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
  clean (only `aws-lc-rs` build-script `NASM found` informational note).
- `cargo xtask public-surface` clean: 35 workspace crates (17 public +
  7 adapter + 11 workspace-only; 0 published-internals remaining).
- `cargo xtask docs-sync --check` clean.
- `cargo xtask check-file-policy` clean (844 files matched, 0 unmatched).
- `cargo xtask no-blob` clean.
- `cargo xtask typos` clean.
- `cargo xtask publish-preflight` clean through every step except the
  expected uncommitted-tree check.
- `cargo test -p xtask -- --test-threads=1` all 245 tests pass; one
  pre-existing parallel-mode CWD test-isolation flake is unrelated to
  this PR.

* chore(workspace): remove folded internal shim crates

Removes 29 fully-folded published-internal compatibility shim crates that
v0.7.x carried as one-minor-release re-export shells over content already
owned by the public crates' `srp::*` modules. This is PR-4 of the v0.8.0
SRP collapse lane and is a BREAKING change for downstream consumers that
pinned the shim crate names directly.

Scope (29 crates removed)

Core internals (11) -> uselesskey_core::srp::*:
- uselesskey-core-cache, -factory, -hash, -id, -seed, -sink
- uselesskey-core-keypair, -keypair-material
- uselesskey-core-negative, -negative-der, -negative-pem

JWK internals (5) -> uselesskey_jwk::srp::*:
- uselesskey-core-kid, -jwk, -jwk-builder, -jwk-shape, -jwks-order

Token internals (4) -> uselesskey_token::srp::*:
- uselesskey-core-base62, -token, -token-shape, uselesskey-token-spec

X.509 internals (5) -> uselesskey_x509::srp::*:
- uselesskey-core-x509, -x509-spec, -x509-derive,
  -x509-negative, -x509-chain-negative

Folded standalones (3):
- uselesskey-core-hmac-spec -> uselesskey_hmac::srp::spec (content moved
  in v0.7.2 via #595; shim removed here)
- uselesskey-core-rustls-pki -> uselesskey_rustls::srp::pki (content moved
  in v0.7.2 via #598; shim removed here)
- uselesskey-pgp-native -> uselesskey_pgp::native (feature = "native";
  content moved in v0.7.2 via #599; shim removed here)

Conditional duplicate (1):
- uselesskey-jose-openid was byte-equal to uselesskey_jsonwebtoken::JwtKeyExt;
  consumers should depend on uselesskey-jsonwebtoken directly.

Why

The v0.7.x line shipped each fold (#595, #598, #599 and predecessors) with
the shim crate retained as a published-internal re-export so v0.7.x
downstreams kept compiling for one minor release. v0.8.0 removes the
shims per the SRP collapse plan; crate-surface contracts at the module
boundary instead of the crate boundary. The published surface goes from
51 to 22 public + 3 workspace-internal.

Migration

Downstream consumers should:
- Replace `uselesskey-core-<x>` imports with `uselesskey_core::srp::<x>`
- Replace `uselesskey-core-jwk*` / `-kid` / `-jwks-order` with `uselesskey_jwk`
- Replace `uselesskey-token-spec` / `-core-base62` / `-core-token*` with
  `uselesskey_token` and its `srp::*` modules
- Replace `uselesskey-core-x509*` with `uselesskey_x509::srp::*`
- Replace `uselesskey-core-hmac-spec` with `uselesskey_hmac::srp::spec`
- Replace `uselesskey-core-rustls-pki` with `uselesskey_rustls::srp::pki`
- Replace `uselesskey-pgp-native` with `uselesskey-pgp` `features = ["native"]`
- Replace `uselesskey-jose-openid::JoseOpenIdKeyExt` with
  `uselesskey_jsonwebtoken::JwtKeyExt`

A full crate-to-module mapping table will land in
docs/how-to/migrate-from-v0.7.md (PR-5).

What this PR touches

- Removes 29 crate directories from `crates/`.
- Updates the workspace `Cargo.toml` `[workspace] members` and
  `[workspace.dependencies]` to drop the removed names.
- Updates `xtask` PUBLISH_CRATES, MUTANT_CRATES, dependents() map,
  `compatibility_shim_owner` callsite, `is_adapter_crate` allowlist,
  and the public-surface internal-shard guard.
- Removes the `is_adapter_crate` jose-openid / pgp-native entries.
- Removes obsolete plan.rs tests that pinned per-shim impact propagation.
- Migrates internal callers (`uselesskey-rsa/-ecdsa/-ed25519` keypair.rs,
  `uselesskey-bdd-steps`, all `fuzz/fuzz_targets/*.rs`) to canonical
  owner-crate `srp::*` paths.
- Regenerates `docs/metadata/workspace-docs.json`, the support matrix,
  and the public-surface survey.
- Resets `policy/no-panic-baseline.toml` to reflect the new module
  topology (deleted crate paths drop out; their canonical owner-crate
  paths are now the only home of the same panic-family findings).
- Notes the cleanup in `CHANGELOG.md` `[Unreleased] Removed`,
  `AGENTS.md`, `CLAUDE.md`, and `docs/explanation/architecture.md`.

Cross-refs: #595 (HmacSpec fold), #598 (rustls-pki fold), #599 (pgp-native
fold) shipped the content moves; this PR removes the now-empty shim
crates.

Validation

- `cargo check --workspace --all-targets --all-features` clean.
- `cargo test --workspace --all-features --exclude uselesskey-bdd --no-run`
  clean.
- `cargo fmt --check` clean.
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
  clean (only `aws-lc-rs` build-script `NASM found` informational note).
- `cargo xtask public-surface` clean: 35 workspace crates (17 public +
  7 adapter + 11 workspace-only; 0 published-internals remaining).
- `cargo xtask docs-sync --check` clean.
- `cargo xtask check-file-policy` clean (844 files matched, 0 unmatched).
- `cargo xtask no-blob` clean.
- `cargo xtask typos` clean.
- `cargo xtask publish-preflight` clean through every step except the
  expected uncommitted-tree check.
- `cargo test -p xtask -- --test-threads=1` all 245 tests pass; one
  pre-existing parallel-mode CWD test-isolation flake is unrelated to
  this PR.

* xtask: drop deleted crates from pr-test orchestration

PR #602 removed 29 shim crates but missed updating the xtask pr
step's per-crate test target list. CI hit
`error: cannot specify features for packages outside of workspace`
for `uselesskey-core-base62`. Update the test-targets list to match
the post-deletion workspace.

The impacted-crates set is derived from the path components of
changed files (`crates/<name>/...`); paths to deleted crates still
appear in the diff and leaked into the test target list. Filter the
list to crates whose `crates/<name>/Cargo.toml` still exists in the
worktree, naturally dropping any crate the PR deletes. Add unit
tests covering the deleted-shim and stale-dir cases.

* chore(fuzz): migrate remaining fuzz targets off deleted shim crates

The shim deletion PR caught 24 of the fuzz targets but left 24 others
still importing the removed crate names (core_factory_cache,
core_x509_negative, fuzz_factory_concurrent, etc.), which broke
`cargo fuzz build`.

Re-point every remaining fuzz target at canonical owner-crate paths:

- uselesskey-core-factory  -> uselesskey_core::Factory
- uselesskey-core-id       -> uselesskey_core::{ArtifactId, DerivationVersion, Seed}
                              + uselesskey_core::srp::identity::derive_seed
- uselesskey-core-hash     -> uselesskey_core::srp::hash::*
- uselesskey-core-keypair-material
                           -> uselesskey_core::srp::keypair_material::*
- uselesskey-core-negative-pem
                           -> uselesskey_core::negative::*
- uselesskey-core-token-shape
                           -> uselesskey_token::srp::shape::*
- uselesskey-core-kid      -> uselesskey_jwk::srp::kid::*
- uselesskey-core-jwk-shape
                           -> uselesskey_jwk::{AnyJwk, Jwks, ...}
- uselesskey-core-jwks-order
                           -> uselesskey_jwk::srp::ordering::*
- uselesskey-core-x509-spec / x509-negative
                           -> uselesskey_x509::{X509Spec, ChainSpec,
                              X509Negative, ChainNegative, KeyUsage,
                              NotBeforeOffset}

* xtask(test): make publish_order_is_topological CWD-independent

The test invoked `cargo metadata` without --manifest-path. When run
in parallel with other xtask tests that change CWD, cargo metadata
could not locate the working directory. Pass --manifest-path derived
from CARGO_MANIFEST_DIR so the test is deterministic under
--test-threads > 1.

* xtask(test): set explicit current_dir on cargo metadata invocation

The prior --manifest-path fix wasn't sufficient because cargo's
working-directory lookup happens before it reads --manifest-path.
When a parallel test deletes its tempdir, the process CWD becomes
invalid and cargo aborts with "Could not locate working directory"
before even seeing the --manifest-path arg.

Explicitly set Command::current_dir to the workspace root so cargo
does not depend on the process CWD at all.

TLS contract-pack and public crate-surface cleanup release. Bumps
workspace to 0.8.0. CHANGELOG entry curated from merged PRs:
#485-#605 (TLS lane #585/#587/#588/#589, task-first how-tos
#590-#594, SRP collapse #595/#598/#599/#602, migration guide #603,
Clippy ratchets #505, dep bumps #484-#491).