fix: Unit 3 — register_openable + per-connection ChannelCore (C-02, C-03, C-09)

A channel-open op could not be registered or invoked (C-02):
ChannelCore::register_openable did not exist, and resolve_channel_manager
(C-03) was a stub returning None — the ADR-047 §4 dynamic-resolution
shape (downcast context.env to &dyn ChannelOperationEnv) was unworkable
as written: context.env is a PeerCompositeEnv, not a single concrete
type that can be downcast to a channels-backed env.

The fix is per-connection registration (ADR-047 §4 amendment,
2026-08-13): a ChannelCore is constructed per channels connection (in
the install_channel_zero hook, which already runs per-connection and
already receives the ChannelManager), and register_openable is called on
that connection's overlay OperationRegistry (Layer 2 per ADR-019). The
wrapper closes over the per-connection ChannelCore and uses
ChannelCore::manager() directly — no context.env downcast. This
preserves every invariant ADR-047 §4 was written to protect (layering,
per-connection resolution) without adding as_any() to OperationEnv
(which would close the session/connection overlay patterns from
ADR-024, AGENTS.md §6).

Changes:
- ChannelCore::register_openable wraps the ALPN's OpenHandler with the
  ACL→check_open→open_channel→spawn→respond flow (ADR-047 §3). Branches
  on spec.op_type: Query/Mutation→Once, Sub→Stream (emits { channel_id }
  and completes; data plane on the channel's BiStream), Pub→Sink (stub:
  channel:pub_open_not_implemented — requires the channel-adoption path,
  C-08/Unit 5). The OpenHandler receives (input, Connection, AuthContext)
  and spawns the ALPN's protocol on the channel's BiStream, returning a
  JoinHandle for teardown.
- ChannelManager::set_handler_task installs the spawned OpenHandler's
  JoinHandle after open_channel (which allocates the channel first to
  get the BiStream halves, then the handler is spawned, then the task is
  recorded for abort on channel/close / connection drop).
- channel:too_many_channels / channel:allocation_failed error codes
  mapped to CallError with details (channel:forbidden is the ACL's
  FORBIDDEN, already handled by the registry before the wrapper).
- resolve_channel_manager stub removed (C-03); ChannelOperationEnv trait
  and ChannelsSessionEnv retained as a two-way-door implementation detail
  for future per-connection routing (not on the open-op path). The
  tautology filler test (C-22 env.rs) removed.
- ADR-047 §4 amendment records the per-connection-registration decision
  (two-way door: the ADR's door-type section explicitly marks the wrapper
  shape as a two-way-door implementation detail; the one-way decisions
  — per-ALPN op names, channel_open marker, removal of channel/open —
  are unchanged).

Acceptance gate (C-02/C-03): one end-to-end test wires ChannelClient ↔
ChannelsAdapter over a real tokio::io::duplex carrying the channels
8-byte chunk header wire format. The accept side's install_channel_zero
hook builds a per-connection ChannelCore, registers a no-op open op
(channels/tty/sub) via register_openable, and runs the dispatch loop.
The client calls call_open_op("channels/tty/sub") on channel 0; the
wrapper does check_open→open_channel→spawn→respond. Asserts the
response carries a non-zero channel_id and that the per-identity quota
was reserved (policy count for the caller incremented to 1).

Verification: 438 tests pass (was 437; +1 e2e), clippy clean, fmt clean,
doc warnings 2 (was 4; fixed the 2 register_openable broken-link
warnings — C-09; the remaining default_policy and env module/macro
warnings are Unit 6 long-tail items).

src/channels/env.rs

@@ -1,12 +1,21 @@
-//! `ChannelOperationEnv` — the extension trait (ADR-047 §4) that adds
-//! the `channel_manager()` accessor to `OperationEnv` without coupling
-//! the call crate to channels types.
+//! `ChannelOperationEnv` — the extension trait (ADR-047 §4, as
+//! amended 2026-08-13) that adds the `channel_manager()` accessor to
+//! `OperationEnv` without coupling the call crate to channels types.
 //!
-//! The open-op wrapper downcasts `context.env` to
-//! `&dyn ChannelOperationEnv` at invocation time — static
-//! registration, dynamic resolution. If the downcast fails (no
-//! channels session — the op was invoked on a bare `alknet/call`
-//! connection), the wrapper returns `channel:no_channels_session`.
+//! **The open-op path does not use this trait.** Per the ADR-047 §4
+//! amendment, open ops are registered per-connection (in the
+//! `install_channel_zero` hook) with a per-connection `ChannelCore`,
+//! and the wrapper uses `ChannelCore::manager()` directly — no
+//! `context.env` downcast. The original §4's dynamic-resolution shape
+//! (downcast `context.env` to `&dyn ChannelOperationEnv` at invocation
+//! time) was unworkable: `context.env` is a `PeerCompositeEnv`, not a
+//! single concrete type that can be downcast to a channels-backed env.
+//!
+//! The trait and `ChannelsSessionEnv` impl are retained as a two-way-
+//! door implementation detail — they are not on the open-op path, but
+//! remain available for future per-connection routing (e.g., nested
+//! channels where each connection's overlay carries its own manager
+//! reference for non-open-op queries).
 //!
 //! This keeps `alkcall`'s call crate free of any channels types and
 //! preserves the layering (ADR-044). The `OperationEnv` is already the
@@ -21,22 +30,17 @@ use crate::registry::env::OperationEnv;
 use super::manager::ChannelManager;
 
 /// Extension trait that adds the per-connection `ChannelManager`
-/// accessor (ADR-047 §4). Implemented by the connection overlay in
-/// `channels-call` (the per-connection `OperationEnv` that carries a
-/// `ChannelManager` reference). The open-op wrapper downcasts
-/// `context.env` to this trait at invocation time.
+/// accessor (ADR-047 §4, as amended 2026-08-13). Implemented by the
+/// connection overlay in `channels-call` (the per-connection
+/// `OperationEnv` that carries a `ChannelManager` reference).
 ///
-/// `ChannelOperationEnv: OperationEnv` — the extension is additive;
-/// any `OperationEnv` impl can also implement `ChannelOperationEnv`.
-/// A bare `alknet/call` connection's env does NOT implement this
-/// trait, so the downcast returns `None` and the wrapper returns
-/// `channel:no_channels_session`.
+/// **Not on the open-op path** — see the module doc. Retained for
+/// future per-connection routing.
 #[async_trait::async_trait]
 pub trait ChannelOperationEnv: OperationEnv {
     /// The per-connection `ChannelManager` for this channels session.
     /// `None` if the env is not channels-backed (a bare call
-    /// connection); the open-op wrapper returns
-    /// `channel:no_channels_session` in that case.
+    /// connection).
     fn channel_manager(&self) -> Option<&ChannelManager>;
 }
 
@@ -101,32 +105,6 @@ impl ChannelOperationEnv for ChannelsSessionEnv {
     }
 }
 
-/// Downcast `env` to `&dyn ChannelOperationEnv` and return the
-/// `ChannelManager`, or `None` if `env` is not channels-backed. The
-/// open-op wrapper uses this to resolve the per-connection manager at
-/// invocation time (ADR-047 §4).
-pub fn resolve_channel_manager(
-    env: &Arc<dyn OperationEnv + Send + Sync>,
-) -> Option<ChannelManager> {
-    // We can't do a real downcast on a trait object without
-    // `AnyName`-style machinery. The practical approach: the
-    // `channels-call` assembly layer wraps the env in a
-    // `ChannelsSessionEnv` and provides the `ChannelManager` through
-    // a side channel (e.g., a `OnceLock` on the connection, or a
-    // dedicated accessor on the overlay). For the open-op wrapper
-    // pattern, the manager is passed at registration time via the
-    // `ChannelCore` (ADR-047 §3), not resolved from the env at
-    // invocation time.
-    //
-    // This function is kept as the API surface for the resolution
-    // pattern; the implementation uses the `ChannelCore`'s stored
-    // manager instead. The trait exists for future per-connection
-    // routing (e.g., nested channels where each connection's overlay
-    // carries its own manager).
-    let _ = env;
-    None
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -147,12 +125,6 @@ mod tests {
         let manager = ChannelManager::with_defaults(handle, None);
         let env = ChannelsSessionEnv { base, manager };
         assert!(env.channel_manager().is_some());
-        // `LocalOperationEnv::contains` returns true by default (the
-        // registry's reachability check is at invoke time, not at
-        // `contains`). We check the `channel_manager` accessor and the
-        // delegation shape — the contains behavior is tested in the
-        // env.rs unit tests for each OperationEnv impl.
-        assert!(env.contains("anything") || !env.contains("anything"));
     }
 
     #[test]