feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/decisions/048-websocket-native-session-not-gateway.md

@@ -361,48 +361,3 @@ transports exist.
   agnosticism") and client-and-adapters spec (§"services/list"); the old
   relative links into the alknet spec tree became textual references to
   the alkcall crate's own documentation.
-
-## Port notes
-
-- **Amended by alkhttp ADR-067, per the status amendment above:** the WS
-  session now carries the **channels protocol** (8-byte chunk
-  multiplexing, alkcall ADR-034/035) with **channel 0 pre-negotiated as
-  `alk/call`** (alkcall ADR-036) instead of a bare `EventEnvelope` WS
-  message stream. The dispatch/overlay/browsers-not-peers content of
-  this ADR stands unchanged and applies to channel 0. The framing on
-  channel 0 is **length-prefixed JSON** (alkcall ADR-014) inside the
-  chunk payload — **not one-envelope-per-WS-message**; the WS message
-  boundary carries chunks, not envelopes (alkhttp ADR-067 §framing).
-  Original one-envelope-per-message sentences are retained as decision
-  history with inline annotations (Decision 1, §Context table,
-  Assumptions 1).
-- **Upgrade path rename:** the default WS upgrade path is `/alk/channels`
-  (was `/alknet/call`) — renamed per the alkcall ADR-004 `alk/` ALPN
-  convention and per alkhttp ADR-067 (the path carries the channels
-  session). The original statement "/alknet/call" appears nowhere in the
-  ported body except as this note.
-- Renames: "alknet-http" → "alkhttp"; `CallAdapter` (old name in the
-  dispatch-loop sentence) is the call-protocol adapter now vendored in
-  the alkcall crate; "alknet ADR-012" (stream model) → **alkcall
-  ADR-015**; "alknet ADR-017 §5" (`to_*` projection) → **alkcall ADR-022
-  §5**; "alknet ADR-024" (registry layering) → **alkcall ADR-019**.
-  alkcall ADR numbers differ from alknet ADR numbers; each citation
-  names the owning crate.
-- alknet ADR-036 (SSE mapping) and alknet ADR-049 (streaming handler)
-  correspond to **alkhttp ADR-049** in this crate; the SSE `/subscribe`
-  references are re-cited accordingly.
-- alknet ADR-043 is cited as an alknet record (not ported to alkhttp);
-  its §2/§3 transfers are restated with alkcall ADR-019 as the overlay
-  citation.
-- Links rewritten per alkhttp conventions: `../crates/http/...` and
-  `../crates/call/...` relative links became textual "alkhttp server
-  spec" / "alkcall crate docs" references (the original
-  `http-server.md` §"WebSocket browser path" and `websocket.md` spec
-  pointers describe alknet spec-tree documents; in this crate the
-  equivalent content lives in the `server`/`websocket` subsystem specs
-  to be written under `docs/architecture/`).
-- `OperationRegistry::invoke()`, `Dispatcher`, `CallConnection`,
-  `PendingRequestMap`, `EventEnvelope` are alkcall-owned types (see
-  alkcall ADR-014/015/019/022); cited textually, not re-defined here.
-- Original title preserved: "WebSocket Carries the Native Call-Protocol
-  Session, Not the Gateway Shape".