feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/014-secret-material-flow-and-capability-injection.md

@@ -210,31 +210,3 @@ should be revisited:
 - alknet OQ-16: Safe vault operations for call protocol exposure (resolved by
   this ADR: none, for now)
 - alkvault crate (extracted from the alknet mono-repo's `alknet-vault`)
-
-## Port notes
-
-- Renames: "alknet-http" → alkhttp; "alknet-core"/"alknet-call" → alkcall
-  (alkcall 0.1.1, which merged the old alknet-core and alknet-call and vendors
-  the core types); "alknet-vault" → alkvault; "the `alknet` crate" (CLI
-  binary) → "the CLI binary (or an embedded assembly layer)" — the CLI crate
-  name is a consumer concern, not an alkhttp one.
-- "over QUIC" → "over the wire" (§Context, `vault/unlock` bullet): the call
-  protocol is transport-agnostic (alkcall ADR-007), so the constraint is
-  transport-independent.
-- §4 correction: the original said the adapter patterns are "defined in Rust
-  in alknet-call per ADR-013". The `OperationAdapter` trait lives in the
-  alkcall crate (alkcall ADR-033, alkcall ADR-022 §5); the HTTP-backed adapter
-  implementations live in alkhttp (alkcall ADR-027 / this crate's ADR-066).
-  The original predates ADR-066's location correction.
-- References to the alknet mono-repo's vault ADRs (ADR-008) and OQs (OQ-04,
-  OQ-15, OQ-16) are annotated as alknet-record citations; the alkcall crate
-  has its own OQ numbering. OQ-15's resolution (the adapter contract) is
-  alkcall ADR-022, ported to this crate as ADR-017.
-- alknet ADR-003 is ported to this crate under the same number and is linked;
-  alknet ADR-005/008/009/013 are cited textually with their alkcall mappings
-  where one exists (alkcall ADR-032 for the one-way-door framework, alkcall
-  ADR-033 for Rust-canonical).
-- No decision content changed — the vault-is-assembly-layer-only rule, the
-  Capabilities injection mechanism, the no-secret-material-on-the-wire
-  constraint, and the credential-source adapter contract are verbatim from
-  the alknet ADR.