feat: complete protocol spec and initial implementation

- Write PROTOCOL.md with full wire format spec and 8 real-world scenario
  analyses (reconnect, multi-operator, large files, AV evasion, router crash,
  malformed packets, future pivoting)

- Rewrite workspace structure:
  - unshell lib: protocol types (PacketHeader, TreeRequest/Response,
    HandshakeMessage/Ack), Transport trait, TcpTransport, Tree routing
  - ush-router: router binary with per-node threads, NodeRegistry with
    longest-prefix path matching, packet relay
  - ush-payload: implant binary with reconnect loop, module tree, InfoModule
  - ush-cli: operator REPL with rustyline, session management, command parser

- Protocol design: two-part rkyv frame [header][payload]; router reads only
  header for routing, payload bytes forwarded opaque

- All code documented with doc comments and examples
- Zero warnings, zero errors across entire workspace
- 32 tests pass (unit tests for tree routing, TCP transport, framing,
  command parsing, node registry)

ush-cli/Cargo.toml

@@ -0,0 +1,28 @@
+# =============================================================================
+# ush-cli — The UnShell Operator REPL
+# =============================================================================
+#
+# The operator CLI is a first-class node in the UnShell network, just like a
+# payload. It connects to the router, registers at /operator/<session_id>,
+# and provides an interactive REPL for issuing commands to connected payloads.
+#
+# Run with:
+#   cargo run -p ush-cli -- --router 127.0.0.1:9000
+#
+# The CLI binary is NOT no_std — it uses the full standard library.
+
+[package]
+name        = "ush-cli"
+version.workspace = true
+edition.workspace = true
+description = "UnShell operator REPL binary"
+
+[dependencies]
+unshell           = { workspace = true, features = ["tcp", "log"] }
+crossbeam-channel = { workspace = true }
+thiserror         = { workspace = true }
+rkyv              = { workspace = true }
+rustyline         = "18.0.0"
+
+[lints]
+workspace = true