Removes 29 fully-folded published-internal compatibility shim crates that
v0.7.x carried as one-minor-release re-export shells over content already
owned by the public crates' `srp::*` modules. This is PR-4 of the v0.8.0
SRP collapse lane and is a BREAKING change for downstream consumers that
pinned the shim crate names directly.

Scope (29 crates removed)

Core internals (11) -> uselesskey_core::srp::*:
- uselesskey-core-cache, -factory, -hash, -id, -seed, -sink
- uselesskey-core-keypair, -keypair-material
- uselesskey-core-negative, -negative-der, -negative-pem

JWK internals (5) -> uselesskey_jwk::srp::*:
- uselesskey-core-kid, -jwk, -jwk-builder, -jwk-shape, -jwks-order

Token internals (4) -> uselesskey_token::srp::*:
- uselesskey-core-base62, -token, -token-shape, uselesskey-token-spec

X.509 internals (5) -> uselesskey_x509::srp::*:
- uselesskey-core-x509, -x509-spec, -x509-derive,
  -x509-negative, -x509-chain-negative

Folded standalones (3):
- uselesskey-core-hmac-spec -> uselesskey_hmac::srp::spec (content moved
  in v0.7.2 via #595; shim removed here)
- uselesskey-core-rustls-pki -> uselesskey_rustls::srp::pki (content moved
  in v0.7.2 via #598; shim removed here)
- uselesskey-pgp-native -> uselesskey_pgp::native (feature = "native";
  content moved in v0.7.2 via #599; shim removed here)

Conditional duplicate (1):
- uselesskey-jose-openid was byte-equal to uselesskey_jsonwebtoken::JwtKeyExt;
  consumers should depend on uselesskey-jsonwebtoken directly.

Why

The v0.7.x line shipped each fold (#595, #598, #599 and predecessors) with
the shim crate retained as a published-internal re-export so v0.7.x
downstreams kept compiling for one minor release. v0.8.0 removes the
shims per the SRP collapse plan; crate-surface contracts at the module
boundary instead of the crate boundary. The published surface goes from
51 to 22 public + 3 workspace-internal.

Migration

Downstream consumers should:
- Replace `uselesskey-core-<x>` imports with `uselesskey_core::srp::<x>`
- Replace `uselesskey-core-jwk*` / `-kid` / `-jwks-order` with `uselesskey_jwk`
- Replace `uselesskey-token-spec` / `-core-base62` / `-core-token*` with
  `uselesskey_token` and its `srp::*` modules
- Replace `uselesskey-core-x509*` with `uselesskey_x509::srp::*`
- Replace `uselesskey-core-hmac-spec` with `uselesskey_hmac::srp::spec`
- Replace `uselesskey-core-rustls-pki` with `uselesskey_rustls::srp::pki`
- Replace `uselesskey-pgp-native` with `uselesskey-pgp` `features = ["native"]`
- Replace `uselesskey-jose-openid::JoseOpenIdKeyExt` with
  `uselesskey_jsonwebtoken::JwtKeyExt`

A full crate-to-module mapping table will land in
docs/how-to/migrate-from-v0.7.md (PR-5).

What this PR touches

- Removes 29 crate directories from `crates/`.
- Updates the workspace `Cargo.toml` `[workspace] members` and
  `[workspace.dependencies]` to drop the removed names.
- Updates `xtask` PUBLISH_CRATES, MUTANT_CRATES, dependents() map,
  `compatibility_shim_owner` callsite, `is_adapter_crate` allowlist,
  and the public-surface internal-shard guard.
- Removes the `is_adapter_crate` jose-openid / pgp-native entries.
- Removes obsolete plan.rs tests that pinned per-shim impact propagation.
- Migrates internal callers (`uselesskey-rsa/-ecdsa/-ed25519` keypair.rs,
  `uselesskey-bdd-steps`, all `fuzz/fuzz_targets/*.rs`) to canonical
  owner-crate `srp::*` paths.
- Regenerates `docs/metadata/workspace-docs.json`, the support matrix,
  and the public-surface survey.
- Resets `policy/no-panic-baseline.toml` to reflect the new module
  topology (deleted crate paths drop out; their canonical owner-crate
  paths are now the only home of the same panic-family findings).
- Notes the cleanup in `CHANGELOG.md` `[Unreleased] Removed`,
  `AGENTS.md`, `CLAUDE.md`, and `docs/explanation/architecture.md`.

Cross-refs: #595 (HmacSpec fold), #598 (rustls-pki fold), #599 (pgp-native
fold) shipped the content moves; this PR removes the now-empty shim
crates.

Validation

- `cargo check --workspace --all-targets --all-features` clean.
- `cargo test --workspace --all-features --exclude uselesskey-bdd --no-run`
  clean.
- `cargo fmt --check` clean.
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
  clean (only `aws-lc-rs` build-script `NASM found` informational note).
- `cargo xtask public-surface` clean: 35 workspace crates (17 public +
  7 adapter + 11 workspace-only; 0 published-internals remaining).
- `cargo xtask docs-sync --check` clean.
- `cargo xtask check-file-policy` clean (844 files matched, 0 unmatched).
- `cargo xtask no-blob` clean.
- `cargo xtask typos` clean.
- `cargo xtask publish-preflight` clean through every step except the
  expected uncommitted-tree check.
- `cargo test -p xtask -- --test-threads=1` all 245 tests pass; one
  pre-existing parallel-mode CWD test-isolation flake is unrelated to
  this PR.

* chore(workspace): remove folded internal shim crates

Removes 29 fully-folded published-internal compatibility shim crates that
v0.7.x carried as one-minor-release re-export shells over content already
owned by the public crates' `srp::*` modules. This is PR-4 of the v0.8.0
SRP collapse lane and is a BREAKING change for downstream consumers that
pinned the shim crate names directly.

Scope (29 crates removed)

Core internals (11) -> uselesskey_core::srp::*:
- uselesskey-core-cache, -factory, -hash, -id, -seed, -sink
- uselesskey-core-keypair, -keypair-material
- uselesskey-core-negative, -negative-der, -negative-pem

JWK internals (5) -> uselesskey_jwk::srp::*:
- uselesskey-core-kid, -jwk, -jwk-builder, -jwk-shape, -jwks-order

Token internals (4) -> uselesskey_token::srp::*:
- uselesskey-core-base62, -token, -token-shape, uselesskey-token-spec

X.509 internals (5) -> uselesskey_x509::srp::*:
- uselesskey-core-x509, -x509-spec, -x509-derive,
  -x509-negative, -x509-chain-negative

Folded standalones (3):
- uselesskey-core-hmac-spec -> uselesskey_hmac::srp::spec (content moved
  in v0.7.2 via #595; shim removed here)
- uselesskey-core-rustls-pki -> uselesskey_rustls::srp::pki (content moved
  in v0.7.2 via #598; shim removed here)
- uselesskey-pgp-native -> uselesskey_pgp::native (feature = "native";
  content moved in v0.7.2 via #599; shim removed here)

Conditional duplicate (1):
- uselesskey-jose-openid was byte-equal to uselesskey_jsonwebtoken::JwtKeyExt;
  consumers should depend on uselesskey-jsonwebtoken directly.

Why

The v0.7.x line shipped each fold (#595, #598, #599 and predecessors) with
the shim crate retained as a published-internal re-export so v0.7.x
downstreams kept compiling for one minor release. v0.8.0 removes the
shims per the SRP collapse plan; crate-surface contracts at the module
boundary instead of the crate boundary. The published surface goes from
51 to 22 public + 3 workspace-internal.

Migration

Downstream consumers should:
- Replace `uselesskey-core-<x>` imports with `uselesskey_core::srp::<x>`
- Replace `uselesskey-core-jwk*` / `-kid` / `-jwks-order` with `uselesskey_jwk`
- Replace `uselesskey-token-spec` / `-core-base62` / `-core-token*` with
  `uselesskey_token` and its `srp::*` modules
- Replace `uselesskey-core-x509*` with `uselesskey_x509::srp::*`
- Replace `uselesskey-core-hmac-spec` with `uselesskey_hmac::srp::spec`
- Replace `uselesskey-core-rustls-pki` with `uselesskey_rustls::srp::pki`
- Replace `uselesskey-pgp-native` with `uselesskey-pgp` `features = ["native"]`
- Replace `uselesskey-jose-openid::JoseOpenIdKeyExt` with
  `uselesskey_jsonwebtoken::JwtKeyExt`

A full crate-to-module mapping table will land in
docs/how-to/migrate-from-v0.7.md (PR-5).

What this PR touches

- Removes 29 crate directories from `crates/`.
- Updates the workspace `Cargo.toml` `[workspace] members` and
  `[workspace.dependencies]` to drop the removed names.
- Updates `xtask` PUBLISH_CRATES, MUTANT_CRATES, dependents() map,
  `compatibility_shim_owner` callsite, `is_adapter_crate` allowlist,
  and the public-surface internal-shard guard.
- Removes the `is_adapter_crate` jose-openid / pgp-native entries.
- Removes obsolete plan.rs tests that pinned per-shim impact propagation.
- Migrates internal callers (`uselesskey-rsa/-ecdsa/-ed25519` keypair.rs,
  `uselesskey-bdd-steps`, all `fuzz/fuzz_targets/*.rs`) to canonical
  owner-crate `srp::*` paths.
- Regenerates `docs/metadata/workspace-docs.json`, the support matrix,
  and the public-surface survey.
- Resets `policy/no-panic-baseline.toml` to reflect the new module
  topology (deleted crate paths drop out; their canonical owner-crate
  paths are now the only home of the same panic-family findings).
- Notes the cleanup in `CHANGELOG.md` `[Unreleased] Removed`,
  `AGENTS.md`, `CLAUDE.md`, and `docs/explanation/architecture.md`.

Cross-refs: #595 (HmacSpec fold), #598 (rustls-pki fold), #599 (pgp-native
fold) shipped the content moves; this PR removes the now-empty shim
crates.

Validation

- `cargo check --workspace --all-targets --all-features` clean.
- `cargo test --workspace --all-features --exclude uselesskey-bdd --no-run`
  clean.
- `cargo fmt --check` clean.
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
  clean (only `aws-lc-rs` build-script `NASM found` informational note).
- `cargo xtask public-surface` clean: 35 workspace crates (17 public +
  7 adapter + 11 workspace-only; 0 published-internals remaining).
- `cargo xtask docs-sync --check` clean.
- `cargo xtask check-file-policy` clean (844 files matched, 0 unmatched).
- `cargo xtask no-blob` clean.
- `cargo xtask typos` clean.
- `cargo xtask publish-preflight` clean through every step except the
  expected uncommitted-tree check.
- `cargo test -p xtask -- --test-threads=1` all 245 tests pass; one
  pre-existing parallel-mode CWD test-isolation flake is unrelated to
  this PR.

* xtask: drop deleted crates from pr-test orchestration

PR #602 removed 29 shim crates but missed updating the xtask pr
step's per-crate test target list. CI hit
`error: cannot specify features for packages outside of workspace`
for `uselesskey-core-base62`. Update the test-targets list to match
the post-deletion workspace.

The impacted-crates set is derived from the path components of
changed files (`crates/<name>/...`); paths to deleted crates still
appear in the diff and leaked into the test target list. Filter the
list to crates whose `crates/<name>/Cargo.toml` still exists in the
worktree, naturally dropping any crate the PR deletes. Add unit
tests covering the deleted-shim and stale-dir cases.

* chore(fuzz): migrate remaining fuzz targets off deleted shim crates

The shim deletion PR caught 24 of the fuzz targets but left 24 others
still importing the removed crate names (core_factory_cache,
core_x509_negative, fuzz_factory_concurrent, etc.), which broke
`cargo fuzz build`.

Re-point every remaining fuzz target at canonical owner-crate paths:

- uselesskey-core-factory  -> uselesskey_core::Factory
- uselesskey-core-id       -> uselesskey_core::{ArtifactId, DerivationVersion, Seed}
                              + uselesskey_core::srp::identity::derive_seed
- uselesskey-core-hash     -> uselesskey_core::srp::hash::*
- uselesskey-core-keypair-material
                           -> uselesskey_core::srp::keypair_material::*
- uselesskey-core-negative-pem
                           -> uselesskey_core::negative::*
- uselesskey-core-token-shape
                           -> uselesskey_token::srp::shape::*
- uselesskey-core-kid      -> uselesskey_jwk::srp::kid::*
- uselesskey-core-jwk-shape
                           -> uselesskey_jwk::{AnyJwk, Jwks, ...}
- uselesskey-core-jwks-order
                           -> uselesskey_jwk::srp::ordering::*
- uselesskey-core-x509-spec / x509-negative
                           -> uselesskey_x509::{X509Spec, ChainSpec,
                              X509Negative, ChainNegative, KeyUsage,
                              NotBeforeOffset}

* xtask(test): make publish_order_is_topological CWD-independent

The test invoked `cargo metadata` without --manifest-path. When run
in parallel with other xtask tests that change CWD, cargo metadata
could not locate the working directory. Pass --manifest-path derived
from CARGO_MANIFEST_DIR so the test is deterministic under
--test-threads > 1.

* xtask(test): set explicit current_dir on cargo metadata invocation

The prior --manifest-path fix wasn't sufficient because cargo's
working-directory lookup happens before it reads --manifest-path.
When a parallel test deletes its tempdir, the process CWD becomes
invalid and cargo aborts with "Could not locate working directory"
before even seeing the --manifest-path arg.

Explicitly set Command::current_dir to the workspace root so cargo
does not depend on the process CWD at all.

TLS contract-pack and public crate-surface cleanup release. Bumps
workspace to 0.8.0. CHANGELOG entry curated from merged PRs:
#485-#605 (TLS lane #585/#587/#588/#589, task-first how-tos
#590-#594, SRP collapse #595/#598/#599/#602, migration guide #603,
Clippy ratchets #505, dep bumps #484-#491).