How is an AAG listener implemented? Where does it run? I'm fairly new to SQL Server but generally well versed in RDBMS and network topics. I'm trying to wrap my head around AlwaysOn Availability Groups. I've read a handful of articles on MSDN and Googled liberally.

I think I understand that the AAG listener appears like a service on the network, it has a hostname and/or IP address and a port number.  And if you create it using SQL Server Management Studio (at least), you create it "in" the server instance which hosts the primary replica.

What I don't understand is what happens under the covers.  Is the listener a thread in the server instance which hosts the primary replica? Is it a separate process?  If so, does it run on the same server or elsewhere in the WFC? If it runs on the same server as the primary instance, how does the listener survive failure of that node?  (The data may well be replicated to a synchronous secondary, but if I can't reach the listner, I can't be redirected to that data.)
The Availability Group Listener (AGL) is part of the AG's Windows Server Failover Cluster (WSFC) Resource. It is a Virtual Network Name with n number of IP addresses. Being in a cluster resource it will only run on a single node of the WSFC and that node will be the primary node of the AG. It is not a thread within SQL Server. The WSFC handles the failover of the AG resource and the AG databases will not come online without the AG resource residing on its node of the WSFC. 

The listener just handles connection forwarding. When connecting to the read/write replica the connection will hit the listener and then the listener will tell the client to connect to the primary replica's IP address. In the case of read-only routing it will follow the below work flow.