Delete impl/rust-ffi/ duplicate; ffi/rust/ is canonical

Closes the duplicate-tree finding from CRG-AUDIT-2026-04-18:

  * Both crates declared the same package identity (`vsh-ffi` library
    `vsh_ffi`, byte-identical Cargo.toml).
  * 6 of 7 sibling source files (audit, errors, operations,
    preconditions, rmo, sandbox) are byte-identical.
  * lib.rs diverges: `ffi/rust/src/lib.rs` is the superset (443 LOC)
    vs `impl/rust-ffi/src/lib.rs` (407 LOC) — extra is `pub mod
    verification;` plus richer doc comments referencing the
    six-system proof stack (Z3/Lean4/Agda/Isabelle/Mizar).
  * `ffi/rust/src/verification.rs` (462 LOC) is unique to ffi/rust/.
  * `ffi/rust/` matches the CLAUDE.md ABI/FFI universal standard
    location (`ffi/<lang>/` per the global "ABI/FFI Universal
    Standard" directory layout).
  * No external build consumers: neither tree is referenced from
    `impl/rust-cli/Cargo.toml`, no path-deps, no Justfile/Containerfile/
    workflow references — only documentation files mention them. The
    main vsh shell crate still builds cleanly after deletion (verified:
    `cargo build` exit 0).

Action: removed `impl/rust-ffi/` entirely (the strict subset). Sweep
of the `.expect("TODO: handle error")` anti-pattern in `ffi/rust/src/`
follows in a separate commit (batch 8).

ROADMAP.adoc v0.9.x item updated to reflect resolution.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

ROADMAP.adoc

@@ -38,8 +38,11 @@ CI on `rust-cli.yml`, dogfood evidence, structural compliance.
 * [ ] Add 3+ ADRs to META.a2ml (six-system proof stack, Rust as primary
   implementation, property-testing as correspondence-gap mitigation) and
   populate `[development-practices]`.
-* [ ] Resolve `impl/rust-ffi/` ↔ `ffi/rust/` duplicate tree (~50
-  `.expect("TODO")` sites in each); decide which is canonical.
+* [x] Resolved 2026-04-19: `impl/rust-ffi/` deleted; `ffi/rust/` is
+  canonical (superset, includes `verification.rs`, matches CLAUDE.md
+  ABI/FFI standard `ffi/<lang>/`). 7 sibling files were byte-identical;
+  `lib.rs` differed only by the `pub mod verification;` export and
+  richer doc-comment proof references. No build consumers.
 * [ ] Complete contractile six-verb layout: create `intend/` (absorbs
   former `lust/`, already removed in commit `a48a1dc`), `adjust/`;
   relocate `k9` out of `contractiles/` per ADR-001 (k9 is svc, not a