feat(tests): the in-process alkcall harness — the serving assembly and the client side over one duplex pair (wave 7)

- the harness lands in src/ops.rs's test tree (#\[cfg(test)] under
  feature ops): serving assembly (OperationRegistryBuilder + CallAdapter
  run loop) and client side (CallClient + spawn_dispatch; ChannelClient)
- the loopback connection source: Connection::from_source with a
  pre-wired multi-stream BidiStreamSource — the QUIC-shaped in-memory
  stand-in stream-per-request needs (a single from_bidi half cannot
  serve spawn_dispatch's call path)
- the channel shape: ChannelsAdapter install hook forks the assembled
  registry, registers the stub openable through
  register_openable_with_establisher (the awaited Establishment phase),
  dispatches via run_loop_single_stream
- the identity/ACL wiring: TestIdentityProvider (token → identity) +
  TestOwnership (namespace → identities → granted actions,
  closed-by-default per OQ-09); call shape rides auth_token resolution,
  channel shape rides the transport-identity seam
- proven with the stub ops: JSON round-trip call → envelope; the ACL
  stub denies anonymous/ungranted and admits granted; the channel stub
  establishes and bytes flow both directions; the refusal arms prove
  ACL-before-establishment and the channel:open_failed/unknown_resource
  reply shape
- dev-dep: async-trait 0.1 (the BidiStreamSource impl); lib tree
  unchanged

verified: cargo test --features ops (88/19/3 green), cargo test
(default, harness compiled out — 73/19/3 green), cargo clippy
--all-targets -- -D warnings on both shapes, cargo fmt --check,
cargo doc --no-deps clean

Cargo.toml

@@ -42,4 +42,5 @@ sha2 = "0.10"
 tokio-postgres = { version = "0.7", optional = true }
 
 [dev-dependencies]
+async-trait = "0.1"
 tokio = { version = "1", default-features = false, features = ["rt-multi-thread"] }