refactor(workspace): rutster-signaling-sip → rutster-trunk; edition 2024; repo URL = git.adlee.work

ADR-0007 lands in code:
- Rename crates/rutster-signaling-sip → crates/rutster-trunk. The crate was
  a stub anyway (lib.rs with a doc-comment + crate_compiles() test); the
  rename locks the new boundary shape — the future rented-transport
  ingress (CPaaS media-leg fork / out-of-tree SBC glue, **no SIP stack**)
  lands here at spearhead step 5.
- rutster-trunk/src/lib.rs doc-comment now describes the ADR-0007 split:
  CPaaS media-leg adapter as primary, out-of-tree SBC for on-prem
  graduation. Cross-refs ADR-0007 + ADR-0008 (FOB vs. green zone: trunk
  is green zone; SIP lives outside the trust boundary).
- rutster-spend/src/lib.rs doc-comment updated to quote ADR-0007's
  'rutster mediates both the provider call-control API and the brain tap'
  framing — the spend gate sits in that boundary, structurally preventing
  a runaway brain from exceeding spend/pacing. Pulling spend out into a
  service re-introduces the 3-vendor structural hole.

Cargo bumps:
- edition = '2024' (slice-1's pinned Rust 1.85 + edition-2024 floor
  already requires this; rutster-media's let-else pattern in
  OpusDecoder::decode · Slice-2's let-else in AcceptOffer's Uuid
  parse_str · all rely on edition 2024's stabilized let-chains / let-else).
- repository = 'https://git.adlee.work/alee/rutster' (the self-hosted
  Gitea remote — matches 'git remote -v' origin). The github.com/anomalyco
  URL was stale from the pre-pivot copy.
- Cargo.lock regenerated by cargo for the rename.

No behavioral code changes — the trunk crate's body is still the stub
crate_compiles() test. FOB membership (per ADR-0008) is unchanged:
rutster-trunk will be FOB-internal at step 5 because it's the media-leg
ingress (hot path); spend-spend stays FOB because spend is
security-constitutive.

crates/rutster-trunk/Cargo.toml

@@ -0,0 +1,8 @@
+# crates/rutster-trunk/Cargo.toml
+[package]
+name = "rutster-trunk"
+version = "0.0.0"
+license.workspace = true
+edition.workspace = true
+repository.workspace = true
+description = "Rented carrier transport — CPaaS media-leg ingress / out-of-tree SBC; no first-party SIP (filled in step 5, ADR-0007)."

crates/rutster-trunk/src/lib.rs

@@ -0,0 +1,24 @@
+//! # rutster-trunk
+//!
+//! **Status:** stub. Fills in at spearhead step 5 (a real phone number via rented transport).
+//!
+//! Carrier / PSTN reach for rutster — **rented transport, no first-party SIP**
+//! ([ADR-0007](../../../docs/adr/0007-trunk-rented-transport.md)). This crate will hold the
+//! rented-transport ingress: the **CPaaS media-leg adapter** — a WebSocket server accepting a
+//! provider raw-media fork (Twilio Media Streams / Telnyx) plus the provider call-control
+//! client — and later the glue for an **out-of-tree SBC** when PSTN media must stay on-prem.
+//! It owns **no SIP stack**: SIP lives outside the trust boundary, in the rented transport
+//! (green zone — [ADR-0008](../../../docs/adr/0008-fob-and-green-zone.md)).
+//!
+//! Slice 1's WebRTC-only ingress needs none of this — this stub exists to lock the crate
+//! boundary without anticipating code (spec §2.2). Its future dependency direction is
+//! `rutster-trunk` → `rutster-call-model` + `rutster-media`: PSTN audio is resampled to the
+//! canonical tap format and handed to the media plane as a media-leg ingress, parallel to
+//! WebRTC.
+
+#[cfg(test)]
+mod tests {
+    /// Stub crates lock boundaries; the compile-test is the lock.
+    #[test]
+    fn crate_compiles() {}
+}