feat(websocket): ride alkcall 0.5.0 — OpenableAlpn establisher + timeout (ADR-049 Unit 3)

Mechanical pass for the alkcall 0.5.0 bump (review 006 sequencing:
ADR-049 → alkcall 0.5.0 → alkhttp mechanical pass):

- bump alkcall 0.4 → 0.5 (gateway feature unchanged)
- OpenableAlpn gains establisher: Option<OpenEstablisher> and
  establisher_timeout: Option<Duration> (both default None via
  OpenableAlpn::new — existing constructions compile unchanged) plus
  a with_establisher(establisher, timeout) builder
- the install_channel_zero ferry calls
  register_openable_with_establisher, threading both fields through
- docs updated (websocket.md, adapter.rs doc comments)

The alkcall 0.5.0 open_channel error-type change (ADR-049 §4) needs
no change here — this crate never calls open_channel (from_wss uses
ChannelClient::from_connection only).

Verification: cargo test (454 passed), cargo test --all-features
(587 passed), cargo clippy --all-targets/-D warnings (default +
all-features), cargo fmt --check

docs/architecture/websocket.md

@@ -275,9 +275,18 @@ that motivated the alknet WebTransport track) workable over WS: the
 SSH byte stream rides a data channel.
 
 The openable set is declared with `HttpAdapter::with_ws_openable_alpns`
-(each `OpenableAlpn { spec, open_handler }`; the ALPN-specific handlers
-stay in the ALPN crates — alkhttp ferries the registrations), with the
-`OpenableAlpns` request-extension fallback for bare-registry/custom
+(each `OpenableAlpn { spec, open_handler, establisher,
+establisher_timeout }`; the ALPN-specific handlers and establishers
+stay in the ALPN crates — alkhttp ferries the registrations). The
+establisher (alkcall 0.5.0 / ADR-049) is the awaited establishment
+phase of the open op: `None` (the default) keeps the pre-0.5 shape —
+the open replies as soon as the pump handler spawns; `Some`
+semantically-validating hook dials/prepares the backend before the
+reply, and a bounded failure resolves `channel:open_failed` with
+`details.reason` (the channel never exists consumer-side). The
+per-registration timeout override bounds the establisher when the
+dispatch carries no deadline. The `OpenableAlpns` request-extension
+fallback is available for bare-registry/custom
 upgrade routes. Cap policy is the `ChannelsPolicy` extension (one
 instance consulted by both the open wrappers and the demux teardown).
 Peer-announced ops (`op/register`) land in the connection-local