Split protocol-level primitives (DID/NSID/DNS identity resolution, generic XRPC HTTP client, session management, record CRUD wrappers, client-side DAG-CBOR CID computation) out of mlf-lexicon-fetcher into a new mlf-atproto crate. The fetcher is refactored to consume it; its public API is preserved. This is the plumbing foundation for mlf-publish, mlf-plugin-host, and the DNS provider plugin binaries.