chore: release alkhttp 0.5.0

- version bump 0.4.1 -> 0.5.0 (minor per the dep-wave convention:
  0.3.0 rode alkcall 0.6.0, 0.4.0 rode alkcall 0.7.0)
- README usage snippet 0.4.1 -> 0.5.0
- changelog: cut [0.5.0] with the alkcall 0.8.0 consumption under
  Changed — the additive-only audit (reply fields, relay/hub-leg,
  flavor-form discovery) and the one ride-through discovery change
  (explicit channel_open_alpn for non-standard open-op names)

Verification: cargo test/clippy/fmt/doc green in the preceding deps
commit; no source change in this commit

CHANGELOG.md

@@ -6,6 +6,34 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-09-18
+
+### Changed
+
+- **`alkcall` dependency bumped to 0.8.0** (review 008's remediation
+  wave: the graduation upstream asks + the in-tree channel relay). No
+  code change in this crate — alkcall 0.8.0 is additive on the
+  call-plane JSON and the registry seams, and none of its new surfaces
+  are constructed here: this crate builds no `Establishment` reply
+  fields (the WS ferry passes `Option<OpenEstablisher>` through
+  unchanged; reply-field projection is an establisher-supplier
+  feature), imports no marked specs through `from_call` (the
+  `from_wss` operation filter excludes the protocol-session ops; any
+  domain op the remote serves imports as a forwarding bundle exactly
+  as before), and consumes neither `ChannelRelay` nor
+  `HubLegImports`/`HubLegTemplate` (hub-leg assembly remains the
+  consumer's concern at the assembly layer). One ride-through visible
+  on this crate's discovery surface: for a deployment's
+  `with_ws_openable_alpns` open-op specs whose names are not standard
+  `channels/<seg>/(sub|pub)` shapes, the served `services/list` /
+  `services/schema` output now carries an explicit
+  `channel_open_alpn` string alongside the boolean marker (alkcall
+  0.8.0's U-1, ADR-047 amendment 3) — so hubs relaying through a
+  `from_call` import of those ops reconstruct the marker instead of
+  seeing plain forwarding stubs. Standard-shape open-op names stay
+  byte-stable. Minor bump per the dep-wave convention (0.3.0 rode
+  alkcall 0.6.0; 0.4.0 rode 0.7.0).
+
 ## [0.4.1] — 2026-09-10
 
 ### Changed

README.md

@@ -161,7 +161,7 @@ A lean single-side build takes `default-features = false` plus the side
 it needs:
 
 ```toml
-alkhttp = { version = "0.4.1", default-features = false, features = ["server"] }
+alkhttp = { version = "0.5.0", default-features = false, features = ["server"] }
 ```
 
 ## Security posture