feat(review 008 Unit 3b): the hub-leg install template (ADR-051 §5)

- src/channels/hub_leg.rs: HubLegImports (the Clone discover/stash,
  bundles split by the channel_open marker, with the per-consumer
  filter) and HubLegTemplate (the hub-leg install hook: per-connection
  fork + generic channel ops + plain bundles as-is + marked specs via
  ChannelRelay::register_relay_openable + bootstrap discovery closed
  over the fork (review 004 F-06) + serving-identity resolution
  (CF-005) + the single-stream dispatch loop).
- The loud assembly posture holds at install: a Pub-typed (or
  unregistrable) marked spec ends the leg's install task — channel 0
  never dispatches, never a silent stub (ADR-051 §6).
- Assembly rule surfaced by the gate e2e: from_call discovers the
  spoke's bootstrap discovery ops like any plain op; the template
  skips BOOTSTRAP_DISCOVERY_OPS (new pub const, discovery.rs) when
  re-registering plain bundles — the template's own install, closed
  over the fork, supersedes the imported copies.
- Gate tests (7): stash split + filter, the full template e2e
  (services/list shows the re-exposed ops, a plain imported op
  round-trips through the hub, the marked op opens through the relay
  with bound surviving, data both directions), serving-identity
  precedence (scope-bearing override resolves, scope-less fails
  closed), the loud Pub-typed posture, and the filtered-stash subset
  run (NOT_FOUND for the filtered-out marked op).
- Docs: ADR-051 status (3a + 3b implemented, 3c remains); review 008
  Unit 3b landed note (the bootstrap-op skip rule).

Verification: cargo test (665 passed), clippy --all-targets
-D warnings, fmt --check, doc --no-deps — all clean.

docs/architecture/decisions/051-channel-relay-and-hub-leg.md

@@ -9,7 +9,10 @@ and 2 (both landed, alkcall 0.7.2): the relay's establisher projects
 the spoke reply's extra fields via `Establishment` reply fields
 (ADR-049 amendment 3), and the spoke's flavor-form open ops arrive
 reconstructed WITH the `channel_open` marker through discovery
-(ADR-047 amendment 3).
+(ADR-047 amendment 3). Unit 3a (the `ChannelRelay` component, §1–§4,
+§6) and Unit 3b (the hub-leg install template, §5) are implemented —
+`src/channels/relay.rs` and `src/channels/hub_leg.rs`; Unit 3c (the
+review's gate-2 e2e harness) remains.
 
 ## Context
 

docs/reviews/008-tunnels-graduation-upstream-review.md

@@ -402,6 +402,18 @@ Verification gates:
 
 ### Unit 3b — the hub-leg install template (the call-half support)
 
+Landed (2026-09-17): `src/channels/hub_leg.rs` — `HubLegImports`
+(the `Clone` stash split by the marker) and `HubLegTemplate`
+(the §5 composition exported as the `InstallChannelZero` hook;
+`serving identity` via the CF-005 seam). One assembly rule the
+planning sketch missed, surfaced by the template's gate e2e:
+`from_call` discovers the spoke's bootstrap discovery ops like any
+plain op, so the template skips
+`registry::discovery::BOOTSTRAP_DISCOVERY_OPS` when re-registering
+plain bundles — the template's own install (closed over the fork,
+review 004 F-06) supersedes the imported copies. Unit 3c (the
+gate-2 e2e) remains.
+
 The hub-side composition every test hand-rolls
 (`make_install_channel_zero`-shaped), exported in-tree (ADR-051 §5 —
 two-way-door API shape):