fix: Unit 3 — register_openable + per-connection ChannelCore (C-02, C-03, C-09)

A channel-open op could not be registered or invoked (C-02):
ChannelCore::register_openable did not exist, and resolve_channel_manager
(C-03) was a stub returning None — the ADR-047 §4 dynamic-resolution
shape (downcast context.env to &dyn ChannelOperationEnv) was unworkable
as written: context.env is a PeerCompositeEnv, not a single concrete
type that can be downcast to a channels-backed env.

The fix is per-connection registration (ADR-047 §4 amendment,
2026-08-13): a ChannelCore is constructed per channels connection (in
the install_channel_zero hook, which already runs per-connection and
already receives the ChannelManager), and register_openable is called on
that connection's overlay OperationRegistry (Layer 2 per ADR-019). The
wrapper closes over the per-connection ChannelCore and uses
ChannelCore::manager() directly — no context.env downcast. This
preserves every invariant ADR-047 §4 was written to protect (layering,
per-connection resolution) without adding as_any() to OperationEnv
(which would close the session/connection overlay patterns from
ADR-024, AGENTS.md §6).

Changes:
- ChannelCore::register_openable wraps the ALPN's OpenHandler with the
  ACL→check_open→open_channel→spawn→respond flow (ADR-047 §3). Branches
  on spec.op_type: Query/Mutation→Once, Sub→Stream (emits { channel_id }
  and completes; data plane on the channel's BiStream), Pub→Sink (stub:
  channel:pub_open_not_implemented — requires the channel-adoption path,
  C-08/Unit 5). The OpenHandler receives (input, Connection, AuthContext)
  and spawns the ALPN's protocol on the channel's BiStream, returning a
  JoinHandle for teardown.
- ChannelManager::set_handler_task installs the spawned OpenHandler's
  JoinHandle after open_channel (which allocates the channel first to
  get the BiStream halves, then the handler is spawned, then the task is
  recorded for abort on channel/close / connection drop).
- channel:too_many_channels / channel:allocation_failed error codes
  mapped to CallError with details (channel:forbidden is the ACL's
  FORBIDDEN, already handled by the registry before the wrapper).
- resolve_channel_manager stub removed (C-03); ChannelOperationEnv trait
  and ChannelsSessionEnv retained as a two-way-door implementation detail
  for future per-connection routing (not on the open-op path). The
  tautology filler test (C-22 env.rs) removed.
- ADR-047 §4 amendment records the per-connection-registration decision
  (two-way door: the ADR's door-type section explicitly marks the wrapper
  shape as a two-way-door implementation detail; the one-way decisions
  — per-ALPN op names, channel_open marker, removal of channel/open —
  are unchanged).

Acceptance gate (C-02/C-03): one end-to-end test wires ChannelClient ↔
ChannelsAdapter over a real tokio::io::duplex carrying the channels
8-byte chunk header wire format. The accept side's install_channel_zero
hook builds a per-connection ChannelCore, registers a no-op open op
(channels/tty/sub) via register_openable, and runs the dispatch loop.
The client calls call_open_op("channels/tty/sub") on channel 0; the
wrapper does check_open→open_channel→spawn→respond. Asserts the
response carries a non-zero channel_id and that the per-identity quota
was reserved (policy count for the caller incremented to 1).

Verification: 438 tests pass (was 437; +1 e2e), clippy clean, fmt clean,
doc warnings 2 (was 4; fixed the 2 register_openable broken-link
warnings — C-09; the remaining default_policy and env module/macro
warnings are Unit 6 long-tail items).

src/channels/manager.rs

@@ -199,6 +199,33 @@ impl ChannelManager {
         Ok((channel_id, send, recv))
     }
 
+    /// Install the handler task for a channel after it has been
+    /// opened via [`ChannelManager::open_channel`] with
+    /// `handler_task: None`. The open-op wrapper (ADR-047 §3) allocates the channel first (to
+    /// get the `MpscSendStream`/`MpscRecvStream` for the channel's
+    /// `Connection`), then spawns the ALPN's `OpenHandler` on that
+    /// `Connection`, then records the resulting `JoinHandle` here so
+    /// `channel/close` / connection drop can abort it.
+    ///
+    /// Returns `UnknownChannel` if the channel was closed between
+    /// `open_channel` and this call (a race — the connection dropped
+    /// mid-open). The caller should treat this as the open having
+    /// been superseded by teardown.
+    pub fn set_handler_task(
+        &self,
+        channel_id: u32,
+        task: JoinHandle<()>,
+    ) -> Result<(), ManagerError> {
+        let mut channels = self.inner.channels.lock();
+        match channels.get_mut(&channel_id) {
+            Some(state) => {
+                state.handler_task = Some(task);
+                Ok(())
+            }
+            None => Err(ManagerError::UnknownChannel(channel_id)),
+        }
+    }
+
     /// Install channel 0 (pre-negotiated as `alknet/call`, ADR-036).
     /// Channel 0 is special only in that it's pre-allocated (by
     /// `channels-call`); the `ChannelsAdapter` hands the resulting