refactor(gateway): migrate to alkcall 0.2 promoted gateway module

Bump the alkcall dependency to 0.2 (with the gateway feature) and
converge on the promoted shared pieces:

- The local dispatch spine (gateway/dispatch.rs, 721 lines) is deleted;
  GatewayDispatch, schema_disclosure_denial, and DEFAULT_DEADLINE are
  re-exported from alkcall::gateway (alkcall ADR-048). The 30 s default
  deadline preserves the previous behavior exactly.
- gateway/schema_cache.rs (PublishSchemaCache) is deleted: alkcall CF-003
  compiles publish_schema at registration time and exposes
  OperationRegistry::publish_validator; the /publish chunk stream
  resolves against it. Un-compilable schemas are now rejected at
  registration, so the two end-to-end fail-closed tests were reworked
  into a registration-rejection test (a stronger guarantee).
- schema_disclosure_denial consumers (to_mcp, routes) use alkcall's
  promoted implementation; the alkhttp-local copy is gone (ADR-071
  updated: the guard stays as defense-in-depth, the implementation no
  longer forks).
- CF-001: from_wss drop monitor and the WS overlay tests use
  CallError::connection_closed; the review-001-ws-eof-signal race tests
  now assert retryable CONNECTION_CLOSED on both resolution paths (the
  tolerated non-retryable INTERNAL write-failure outcome is gone).
- Added CHANGELOG.md (Keep a Changelog), Unreleased section records the
  bump and convergence.

Verification: cargo test default 453 ok, wss 470 ok, mcp 526 ok,
all-features 575 ok; clippy -D warnings clean (default + all-features,
all-targets); fmt clean; cargo doc warning-free.

Net: -1093 lines.

tests/ws_overlay_ops.rs

@@ -367,14 +367,12 @@ async fn ws_close_mid_call_to_browser_op_aborts_call() {
         )
     };
 
-    let failed = conn
-        .pending()
-        .lock()
-        .fail_all(alkcall::protocol::wire::CallError::new(
-            "CONNECTION_CLOSED",
-            "ws dropped",
-            true,
-        ));
+    let failed =
+        conn.pending()
+            .lock()
+            .fail_all(alkcall::protocol::wire::CallError::connection_closed(
+                "ws dropped",
+            ));
     assert!(failed.contains(&"hub-call-inflight".to_string()));
 
     let result = tokio::time::timeout(Duration::from_millis(100), rx).await;