docs: define initial net.socket contract

[vycdev2]

Summary

• define a TCP-first net.socket contract covering validated endpoints, linear stream/listener handles, deadlines, cancellation, partial I/O, and lifecycle rules
• specify exact outbound-only Network.allow behavior and the public-source/private-runtime boundary
• link the proposed contract from the documentation inventory, design, architecture, and progress references

Verification

• cargo fmt --check — passed
• cargo build — passed
• cargo test -q — passed, including all 432 driver fixture tests
• git diff --check — passed
• test -f docs/open_design/net_socket_transport_contract.md — passed; the new local link target exists

Risk

• Medium: documentation-only with no runtime behavior change, but it selects public socket semantics that should be reviewed before implementation.

Closes #104

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.

[vycdev]

This proposal introduces net.socket.* as the canonical TCP surface, but the still-normative design and architecture text continues to teach and map Network.listen, Network.connect, and Network.accept (for example the capability examples and platform runtime table around docs/design.md lines 3158–3238, plus docs/architecture.md's runtime-backed stdlib example). That leaves agents with two canonical public socket spellings, contrary to the repository's one-canonical-spelling rule.

Before closing #104, please reconcile or explicitly retire the existing Network.* socket API examples and runtime mappings so the contract exposes one public surface.