test(review 009): all seven coverage findings; errata on three as-filed claims

Review 009's coverage debt in full — the paths the review-008 gates
never walk. No wire or API changes.

- C-1: pin the plain-bundle install-failure arm (un-compilable
  input_schema; the as-filed duplicate-name route does not fail
  registration) — the install task ends before the dispatch loop,
  channel 0 never dispatches. ADR-051 §5 gains the loud-install
  coverage note: relay-openable + plain-bundle arms pinned,
  generic-ops + bootstrap-discovery arms documented as
  best-effort-loud (crate-internal specs compile by construction).
- C-2: the HubLegImports filter — filtered closure path + only
  partition unit-tested (errata: only was already pinned at filing);
  the empty-stash e2e gate (generic ops + discovery only, dropped
  ops resolve NOT_FOUND).
- C-3: the batch-form reserved-reply-key rejection pinned (reason
  handler_error, teardown, ledger decrement, no pump spawn).
- C-4: open_channel_with_reply's failure path pinned e2e (the typed
  error carries the channel:open_failed code + details reason/message).
- C-5: both byte-identical claims golden-pinned — the no-fields reply
  against {"channel_id": 2} and the standard-shape wire payload
  against the full 9-key literal.
- C-6: derivation edge shapes pinned — channels//sub, channels//direct,
  channels → None; the 4-segment strict superset annotated as the
  pre-amendment behavior change (errata: actual is Some("x/sub"), the
  multi-segment-ALPN rule, not the as-filed Some("alk/x/sub")).
- C-7: builder overwrite pinned last-win (single + batch) with the
  doc sentence on with_reply_field.

Verification: 682 tests pass, clippy -D warnings clean, fmt clean,
doc clean, wasm32 check clean.

File: docs/reviews/009 (resolved; errata marked per finding)

docs/architecture/decisions/051-channel-relay-and-hub-leg.md

@@ -189,6 +189,20 @@ spec's ACL (+ hub policy) on the consumer leg; the spoke-side grant
 goes to the hub identity, which needs scopes on every spoke op it
 relays. The end consumer never authenticates to the spoke directly.
 
+**Loud-install coverage note (review 009 C-1):** the template's four
+install-failure arms all end the install task before the dispatch
+loop (channel 0 never dispatches — never a silent stub). Two arms are
+unit-test-pinned: the relay-openable registration failure (the
+Pub-typed marked spec gate) and the plain-bundle registration failure
+(an un-compilable schema — the registry's fail-closed rule). The
+other two arms — generic channel-ops registration and bootstrap
+discovery install — are best-effort-loud: both register
+crate-internal specs whose schemas compile by construction, so
+failure is not reachable through any public path and an injectable
+failure seam would test the seam, not the arm. This note is the
+contract: if a future change makes either arm reachable, it gets the
+same pin.
+
 ### 6. Bounds: rejected shapes and residual notes
 
 - **Pub-typed open ops** — rejected loudly (`channel:pub_open_not_implemented`,