docs(review 007 Unit 2): WS-31 discovery-shadowing note + record corrections

- WS-31: websocket.md §"Data channels for browsers" + ADR-067's landed
  note record that WS-session discovery is the bootstrap set — the
  hook's bootstrap `services/*` registrations overwrite a
  base-registry `services/*` registration on the WS path by design
  (a deployment's custom `services/list` is shadowed on WS sessions
  only).
- ADR-048's landed note: correction + completion — the WS-26
  retention sentence was aspirational at the landed commit (WS-28) and
  is now real; the UP-02 posture's override half is now an explicit
  surface (`with_ws_op_register_acl` / `OpRegisterAcl`), with the
  note that `ChannelsPolicy` could not carry an op ACL.
- ADR-067's landed note: review-007 notes (WS-28 fix + gate, WS-29
  surface, WS-31 record).
- OQ-05 resolution: the retention claim carries the WS-28 correction.
- review-006 UP-02 log + WS-26 paragraph: corrections marking what the
  pre-fix tree did not have, with the landed remediation named.
- review-002 WS-17: the "bounded at 64 sessions" claim corrected —
  the bare-registry semaphore was per-request and bounded nothing;
  `SessionSlots` is the shared-cap surface.
- review-007 status: open for remediation → remediated, with the
  decisions taken (both "implement" options) and the gate names.

Verification: cargo test 454 passed / 0 failed; cargo doc --no-deps
clean (6 pre-existing warnings, identical at baseline).

Review: docs/reviews/007-ws-data-channel-surface-review.md

docs/architecture/open-questions.md

@@ -104,7 +104,12 @@ with their resolutions; new alkhttp OQs start at OQ-01.
   `op/register` (alkcall ADR-022 amendment), then dispatches over the
   fork — alkcall ADR-047 §4 amendment #2's per-session-fork shape.
   The session retains its live `Arc<CallConnection>` in `WsSessions`
-  (evicted with the session). One premise of the original deferral
+  (evicted with the session; review 007 WS-28 corrected the landed
+  guard's scope — the handle was retained for microseconds, not the
+  task's lifetime — and its remediation bound the guard in the
+  channel-0 task's frame, gated by
+  `live_connections_visible_mid_session_and_drain_after_teardown`).
+  One premise of the original deferral
   was corrected along the way (review-003 WS-23): "reopened when a
   browser consumer lands" underestimated the consumer set — WS is
   also the native-client fallback behind hostile NAT/firewall, and a