feat(infra): full-surface integration suite + docs sync + publish prep

Full-surface integration suite (tests/full_surface.rs, mcp feature):
- one HttpAdapter over real TCP (ProtocolHandler::handle path) serving
  gateway endpoints, /openapi.json, /mcp, and the WS channels session
- gateway: search/schema/call/subscribe/batch/publish presence,
  envelope shapes, error fidelity end-to-end
- from_openapi import -> Internal-by-default invisible from the wire ->
  External facade composes it via env.invoke -> upstream HTTP API
  called end-to-end (ADR-015 composition model exercised)
- to_openapi 6-path doc validated against openapiv3 over the wire
- to_mcp: MCP client connects to /mcp on the served adapter, lists the
  4 gateway tools, search returns ACL-filtered ops (Sub excluded)

Production fix: the WS upgrade route was reserved but never wired into
HttpAdapter's router (the ws-upgrade-session tests built their own
router). Now wired with ws_bearer_auth (401 without a resolvable
token) around ws_upgrade_handler.

Docs sync: all 28 'Port notes' sections/blockquotes stripped from
ported ADRs/specs; OQ-01/OQ-02 statuses corrected to resolved in
overview.md, websocket.md, and the README table (open-questions.md was
already current).

Publish prep: cargo publish --dry-run --allow-dirty succeeds;
cargo doc --no-deps warning-free (ADR link targets fixed); feature
combinations (default / test-support / mcp / wss / all) compile
warning-free under clippy -D warnings.

Verified: cargo test (182 lib default), --all-features (227 lib + 29
integration), clippy -D warnings x3 feature sets, fmt, doc,
publish --dry-run.

docs/architecture/http-mcp.md

@@ -415,67 +415,3 @@ See [open-questions.md](open-questions.md) for full details.
 - `/workspace/@alkdev/alknet/docs/research/alknet-http-gateway-factoring/findings.md`
   — research on the shared dispatch spine between `to_mcp` and
   `to_openapi` (recommendation: thin shared struct, not a trait)
-
-## Port notes
-
-Corrections applied during the alknet → alkhttp port, beyond mechanical
-crate renames (`alknet-http` → `alkhttp`; `alknet-call`/`alknet-core` →
-`alkcall`, with the adapter contract in `alkcall::client`, registry
-types in `alkcall::registry`, core in `alkcall::core`):
-
-1. **`OperationType::Subscription` renamed `Sub`** (alkcall rename);
-   `OperationType::Pub` exists (producer→consumer streaming,
-   `HandlerKind::Sink`, wire event `call.published` — alkcall ADR-046).
-   The MCP gateway exclusion was a "Subscription excluded" claim in the
-   source; extended to cover both `Sub` (streaming responses) and `Pub`
-   (streaming requests) — MCP tool calls are request/response, so
-   neither fits. The section is retitled "`Sub` and `Pub` exclusion".
-   `to_mcp` stays 4 fixed tools.
-2. **The OpenAPI gateway now has 6 endpoints.** `/publish` (Pub, NDJSON,
-   alkhttp ADR-068) joined the original five. The shared-dispatch-spine
-   cross-reference updated accordingly ("streaming (excluded in
-   `to_mcp` vs `to_openapi`'s `/subscribe` SSE and `/publish`
-   NDJSON)"; the `/subscribe` mention in the Sub-exclusion section now
-   cites `/publish` too). `to_mcp` has no `/publish` analog — the 4
-   tool set is unchanged.
-3. **ADR cross-reference remapping.** Call-protocol-internal decisions
-   now live in the alkcall crate and are cited textually (no relative
-   links across crates): old ADR-017 adapter contract → alkcall ADR-022
-   (§5 mapping preserved); old ADR-022 handler registration → alkcall
-   ADR-018; old ADR-023 error schemas → alkcall ADR-016; old ADR-015
-   privilege model → alkcall ADR-017; old ADR-049 streaming handler →
-   alkcall ADR-021 (the `GatewayDispatch` spine clause is alkcall ADR-021
-   §7); Pub/`HandlerKind::Sink` → alkcall ADR-046. The old ADR-029 §5
-   citation for `FromCallConfig::namespace_prefix` (peer-graph collision
-   rule) → alkcall ADR-024 §5 (the alkcall peer-graph routing model;
-   alkcall's ADR-029 is a different, later decision — aggregated peer-env
-   wiring).
-4. **alkhttp-owned ADRs keep their numbers and are linked relatively:**
-   014, 034, 004 (ported files exist); 037, 041 (being ported in
-   parallel — linked per instruction); 036, 047, 068 (linked by
-   inference — their ports are assumed, consistent with
-   http-adapters.md/http-server.md practice). The old ADR-036 "same
-   dispatch path the HTTP server uses" citation was extended with
-   ADR-047 (the gateway is the sole invoke path; ADR-047 supersedes
-   ADR-036's direct-call surface) so the reference reflects the current
-   architecture.
-5. **Terminology.** "MCP clients are not alknet peers" → "not alk
-   peers"; "outside alknet" → "outside alkhttp"; "alknet's
-   auth/identity/capabilities machinery" → "alkhttp's". No call-protocol
-   server/client framing existed in the source; the remaining
-   server/client wording (rmcp streamable HTTP server/client, axum
-   server, remote MCP server, stdio-only MCP server) is MCP's inherent
-   transport directionality and is deliberately retained.
-6. **Project naming.** "lets alknet compose external MCP servers" →
-   "lets the alk stack compose"; "calls alknet operations" → "the local
-   deployment's operations" in the Why prose.
-7. **Links.** `../../decisions/` → `decisions/`;
-   `../../open-questions.md` → `open-questions.md` (sibling, pending
-   port); `../call/client-and-adapters.md` → textual reference to the
-   alkcall crate's `docs/architecture/client-and-adapters.md`; the
-   mono-repo research findings path is kept as a textual absolute path
-   (the findings doc was not ported). `overview.md` and
-   `http-adapters.md` are sibling links (overview.md pending port).
-   OQ-14/OQ-40 references kept as-is (OQ-14 is a call-protocol OQ — the
-   alkcall crate's `docs/architecture/open-questions.md`; OQ-40 is the
-   shared reqwest client config, resolved).