feat(cf-006/cf-007): per-call opener identity for open-op hooks; ADR-016 code-list sweep

Batch-fixes every remaining open alkcall-side finding from downstream
consumers so 0.7.0 is the only release they need to absorb.

- CF-006 (the CF-005 corollary): run_open_wrapper derives a per-call
  AuthContext — the opener's dispatch-resolved identity (the same
  identity the ACL gate and cap check saw) overlaid onto the
  install-time context — and passes it to both the establisher and
  the pump handler. Identity-less calls keep the install-time
  identity (no synthetic-anonymous rewrite); transport-truthful
  fields are never rewritten. Signatures unchanged — behavior-only;
  identical on per-connection registries, hub-forwarded opens now
  show the end client. Gates:
  open_wrapper_overlays_per_call_identity_on_install_time_auth +
  open_wrapper_keeps_install_time_identity_when_call_identityless.
- CF-007 (alkhttp review 006 Part C doc drift): ADR-016 amended to
  the eight-code list — ALREADY_EXISTS + CONNECTION_CLOSED in the
  Context, §3 table, and from_openapi collision rule; new §2a
  documents the undelivered-vs-ambiguous write-failure distinction.
- ChannelPlan type doc now states the Send + Sync payload constraint
  (alktunnels POC F-1 re-derived it by compiler error).
- Ledger: CF-006 and CF-007 filed + resolved; CF-005's corollary
  note points at CF-006; the Open section is empty. ADR-049 gains
  the per-call-identity note. Changelog 0.7.0 covers the batch.

Sweep result (all downstream reviews): no other open alkcall items —
alktunnels W3/F-2 are downstream-by-design, alktty R3/P14 are closed
constraints, alknet has none; OQ-24/37/39/40/41 stay
deferred-by-design (no consumer pull yet).

Verification: cargo test (631) + --all-features (648), clippy
(all-targets, all-features, -D warnings), fmt --check, doc
--no-deps, wasm32 check, semver-checks (no update required),
publish --dry-run.

docs/architecture/decisions/049-channel-open-establishment-phase.md

@@ -332,6 +332,15 @@ implementation detail; the wire surface is unchanged from §1/§3):
    `Fn(Value, AuthContext) -> BoxFuture<'static,
    Result<Establishment, EstablishmentError>>`; the `Connection`
    belongs exclusively to the `OpenHandler` (unchanged).
+   **Identity semantics (CF-005 corollary, 2026-09-07):** the
+   `AuthContext` the establisher and the pump handler receive is the
+   **per-call** context — the opener's dispatch-resolved identity (the
+   same identity the ACL gate and the per-identity cap check saw)
+   overlaid onto the install-time context; transport-truthful fields
+   (`alpn`, `remote_addr`, `tls_client_fingerprint`) stay
+   install-time. On a per-connection registry (ADR-047 §4) this is
+   identical to the install-time context; on hub-forwarded opens the
+   establisher sees the end client, not the hub.
 2. **The bound is the earlier of the dispatch deadline and the
    per-registration timeout.** §2 names the dispatch deadline "when
    the `OperationContext` carries one, else the crate constant";