feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/003-crate-decomposition.md

@@ -148,26 +148,3 @@ ADR-064 (irpc-never-integrated-hand-rolled-framing, in the alknet
 mono-repo ADRs) for the full
 record (ADR-005, which accepted "irpc as the call protocol foundation," is
 superseded).
-
-## Port notes
-
-- This is the historical alknet decomposition ADR, ported because alkhttp's
-  dependency edges are defined here (Amendment 1 in particular). The table's
-  crate names are annotated in place where the extraction renamed them:
-  alknet-core + alknet-call merged into **alkcall** (which vendors the core
-  types); alknet-vault → **alkvault**; alknet-http → **alkhttp**. The
-  dependency-flow diagram keeps the generic "core"/"call" labels it
-  historically used; "call ← alknet-agent / call ← alknet-napi" describe
-  the alknet mono-repo, not alkhttp's own edges.
-- Per the task instructions, both amendments are retained. Amendment 1's
-  statement of the alkhttp edge ("alknet-http depends on alknet-call")
-  now reads as **alkhttp depends on alkcall alone** — the "depends on
-  `alknet-core, axum`" dependency in the table is now `alkcall, axum`.
-- Link targets `crates/http/overview.md` and
-  `crates/call/client-and-adapters.md` (mono-repo doc paths) replaced:
-  the former points to `overview.md` in `docs/architecture/`, the latter
-  is a textual "alkcall crate docs" reference. ADR-057/ADR-064 links are
-  textual (those ADRs are not ported to alkhttp).
-- ADR-057 and ADR-064, and the code-path references
-  (`crates/alknet-call/src/protocol/wire.rs`), are alkcall-internal
-  concerns; referenced textually.