[M2] mxaccess-rpc: NTLMv2 + DCE/RPC PDU + OBJREF parser (wave 1)

Lands M2 wave 1 — three pure-Rust modules under crates/mxaccess-rpc with
60 unit tests. Each is a 1:1 port of one .NET reference file:

- ntlm.rs (1137 LoC, 19 tests) — `ManagedNtlmClientContext.cs`. NTLMv2
  challenge/response, Type1/Type3 builders, sign() with RC4-sealed checksum
  and per-call sequence advance. Manual `Debug` impl that hides credentials;
  not Clone (rc4 0.2 cipher state is non-Clone). Pure-Rust crypto via
  hmac/md-5/md4/rc4 v0.2/rand v0.8 (rc4 0.2 chosen per design/review.md:78).
- pdu.rs (1573 LoC, 33 tests) — `DceRpcPdu.cs` + auth-trailer types from
  `DceRpcAuthentication.cs`. Bind/AlterContext/Auth3/Request/Response/Fault
  PDUs, NDR20 transfer syntax, auth_value with 4-byte alignment padding,
  preserved-byte fields per CLAUDE.md unknown-bytes rule.
- objref.rs (~470 LoC, 11 tests including a 366-byte captured OBJREF
  round-trip) — `ComObjRef.cs`. MEOW signature, OXID/OID/IPID, dual-string
  array with printable-ASCII escaping and security-binding boundary.
  ComObjRefProvider.cs deferred (windows-rs Win32 wrapper — see F6).

Every wire-byte claim cites src/MxNativeClient/<file>.cs:LINE per
CLAUDE.md "no fabricated protocol behaviour" rule.

Test count delta: 217 → 277 (+60)
Open followups touched: F1–F8 (new — see design/followups.md)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rust/crates/mxaccess-rpc/src/lib.rs

@@ -1,10 +1,17 @@
 //! `mxaccess-rpc` — DCE/RPC + NTLMv2 + OBJREF + OXID + IRemUnknown::RemQueryInterface.
 //!
-//! M0 stub. Real implementation lands in M2 — see `design/60-roadmap.md`.
+//! M2 wave 1 landed: `ntlm`, `pdu`, `objref`. OXID resolution and
+//! `IRemUnknown::RemQueryInterface` follow in wave 2; the callback exporter
+//! in wave 3 — see `design/60-roadmap.md` and `design/dependencies.md`.
 //!
 //! Internal `unsafe` is permitted only for `windows-rs` COM activation paths
 //! (per `design/00-overview.md` principle 3); all such calls must be wrapped
-//! in safe abstractions at the crate boundary.
+//! in safe abstractions at the crate boundary. Wave 1 modules are pure-Rust
+//! and contain no `unsafe`.
 
 // `mxaccess-rpc` is the only crate where internal unsafe is permitted (for
 // windows-rs COM calls). Public API stays safe.
+
+pub mod ntlm;
+pub mod objref;
+pub mod pdu;