feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/044-defer-webtransport-browsers-use-websocket.md

@@ -465,10 +465,10 @@ revival question.
   on the explicit distinction between deferral-as-hedging (rejected)
   and deferral-as-scoping (permitted: a decision that "genuinely
   doesn't need to be made yet because the use case isn't concrete" —
-  scope management, not door-type classification). *(Port note: the
-  one-way-door decision framework lives in the alkcall crate as
-  alkcall ADR-032 — see the alkcall crate docs; alkhttp did not port
-  it. The original linked alknet ADR-009 by relative path.)*
+  scope management, not door-type classification). The one-way-door
+  decision framework lives in the alkcall crate as alkcall ADR-032 —
+  see the alkcall crate docs; alkhttp did not port it. The original
+  linked alknet ADR-009 by relative path.
 - alknet ADR-038 — **superseded by this ADR (in alknet).** Its
   correction of the two-way-door-as-deferral anti-pattern stands; its
   specific decision (h3 in scope now) is reversed. **Not ported to
@@ -511,45 +511,3 @@ revival question.
   shape (see the alkcall crate's own documentation; the old
   `call-protocol.md` relative link pointed into the alknet mono-repo
   spec tree).
-
-## Port notes
-
-- **Superseded in part, per the status amendment above:** the "deferred"
-  framing is superseded by alkhttp ADR-069 (WebTransport removed from
-  alkhttp scope entirely). §1's WebSocket-as-browser-path stands; the
-  reversal trigger, the "revival" mechanics, the `webtransport.md` spec
-  pointer, and the research-spike-for-revival posture are alknet-record
-  content retained for provenance and annotated. alknet ADR-038/040/043
-  are not ported to alkhttp.
-- **Framing correction:** the original assumed "one `EventEnvelope` = one
-  WS binary message." In the current wire model the WS message boundary
-  carries 8-byte channels chunks (alkcall ADR-034/ADR-035); channel 0 is
-  pre-negotiated `alk/call` (alkcall ADR-036) and carries `EventEnvelope`
-  frames as length-prefixed JSON (alkcall ADR-014) inside the chunk
-  payload. The original sentences asserting one-envelope-per-WS-message
-  are annotated inline (Finding 1 correction, Assumption 1) rather than
-  silently rewritten; the operative statement for this crate is alkhttp
-  ADR-067.
-- Renames: "alknet-http" → "alkhttp"; the QUIC call ALPN "alknet/call" →
-  "alk/call" (alkcall ADR-004 `alk/` convention); "alknet ADR-012" (the
-  old call-protocol stream model) is cited as **alkcall ADR-015**
-  (alkcall ADR numbering differs from alknet numbering — alkcall ADR-012
-  is `ConnectionCredentials`, not the stream model).
-- The original's references to `crates/http/webtransport.md` and
-  `crates/http/http-server.md` are alknet spec-tree artifacts; the
-  `webtransport.md` spec does not exist in alkhttp (no deferred
-  WebTransport spec is carried in this crate). The alkhttp equivalent of
-  the http-server spec work is the `websocket`/`server` subsystem of
-  this crate and alkhttp ADR-048.
-- The `@alkdev/pubsub` prior-art references are kept as absolute
-  workspace paths (the packages still exist at those locations); the
-  framing delta note is annotated per the channels-chunk correction.
-- The original table in §4 had an implied `h3` row (WebTransport →
-  alk/http in the alknet ALPN table); that row is dropped from the
-  alkhttp transport table per alkhttp ADR-069, with a note in §4.
-- iroh-relay precedent: kept — it is a design-signal argument, not a
-  dependency claim; alkhttp has no iroh dependency.
-- Original title preserved: "Defer h3/WebTransport; Browsers Use
-  WebSocket". The title's "defer" is the alknet-record posture; in
-  alkhttp the operative reading is "no WebTransport in this crate;
-  browsers use WebSocket" (alkhttp ADR-069).