phase 1 scaffold: cargo workspace + 3 crates + roadmap + architecture

Repo skeleton for aldabra, the rust-native cardano lite wallet
with MCP server interface. Builds end-to-end, types in place,
real cardano primitives land next pass.

Crates:
  wallet-core   — pure crypto + types. mnemonic, key derivation,
                  signing. No I/O. Security boundary.
  wallet-chain  — pluggable backends. ChainBackend trait, Koios
                  client (stub for now). Ogmios + submit in phase 2.
  wallet-mcp    — the binary. stdio MCP transport via rmcp.

Phase plan in ROADMAP.md, threat model in docs/architecture.md.

This is also Sulkta's first Rust project + a real-world workout for
ci-runner's rust toolchain.

crates/wallet-core/Cargo.toml

@@ -0,0 +1,35 @@
+# wallet-core — pure crypto + types. No I/O, no network. Deterministic
+# given the same mnemonic + derivation path.
+#
+# This crate is intentionally narrow:
+#   - Mnemonic → root key
+#   - Root key → payment / stake key (CIP-1852 derivation)
+#   - Address construction (mainnet, testnet)
+#   - Transaction signing (given an unsigned TX builder output from
+#     wallet-chain or pallas-txbuilder)
+#
+# It deliberately does NOT:
+#   - Do any chain queries (that's wallet-chain's job)
+#   - Talk to MCP (that's wallet-mcp's job)
+#   - Touch files (the daemon owns disk I/O; we get keys handed in)
+#
+# Rationale: this is the most security-sensitive crate. Keeping it
+# narrow + I/O-free makes it auditable.
+
+[package]
+name = "wallet-core"
+version.workspace = true
+edition.workspace = true
+license-file.workspace = true
+repository.workspace = true
+authors.workspace = true
+
+[dependencies]
+pallas-primitives = { workspace = true }
+pallas-codec = { workspace = true }
+pallas-crypto = { workspace = true }
+pallas-addresses = { workspace = true }
+bip39 = { workspace = true }
+zeroize = { workspace = true }
+thiserror = { workspace = true }
+serde = { workspace = true }