Verify the transport-independent library boundary

[RobLe3]

Summary

• enforce the transport-independent public-library boundary with a locked, no-default-features library check
• document where task identity, lifecycle, framing, admission, and provider selection remain separate from the experimental TCP binding
• add deterministic source contracts so later QUIC work requires a new transport implementation rather than an IICP semantic redesign

Closes #159.

Validation

• python3 scripts/run_sdk_quality.py --output /tmp/iicp-rust-transport-quality.json
  • Rust 1.86 and stable suites passed
  • clippy passed with warnings denied
  • RustSec audit passed with the existing allowed yanked-lockfile warning
  • coverage 68.58% (minimum 64%)
  • package, exact locked install, CLI version, and supported-image instance-lock gates passed
• cargo check --locked --no-default-features --lib
• targeted native identity, response sequence, lifecycle, concurrency, and transport-separation tests
• python3 scripts/check_workflow_yaml.py .github/workflows
• sentrux check .

The current Sentrux analyzer reports the same stale complex-function baseline drift on exact origin/main and this branch (58 to 64, with identical quality 6335 and coupling 0.37); the branch introduces no additional structural change relative to main.