release: v0.3.0 — the dependency-major (alkcall 0.10.0 / alktunnels 0.4.0)

- alkcall 0.9.0 -> 0.10.0 (the gateway ownership-seam release): the
  GatewayDispatch ownership-provider threading + the loud unwired-spine
  default are not on this crate's paths (no gateway module use; registry
  dispatch on the native wire untouched). Zero API/wire change here.
- alktunnels 0.3.0 -> 0.4.0 (its dependency-major ride): no alktunnels
  API/wire change; the composed providers see none of it.
- fuzz/shared: the harness's own alkcall pin bumped in lockstep (its
  ChannelOpenError construction makes a drifting pin a duplicate-type
  compile failure, not silent drift) — the only bump contact.
- Docs: CHANGELOG 0.3.0 entry, README version blurb (alktunnels style),
  AGENTS.md pin update, deps tree in overview.md.
- Minor-not-patch for the established reason: semver-incompatible
  dependency bumps + this crate's public ChannelOpenError re-exports
  (SocksOpenError::Open/open_ref) are semver-visible downstream.

Verification: cargo test (default 145 unit + suites green), --features
local, --all-features (171 unit + all suites), clippy --all-targets
--all-features -D warnings, fmt --check, wasm32-unknown-unknown check +
clippy, fuzz corpus replay 3/3, publish --dry-run clean.

docs/architecture/overview.md

@@ -120,7 +120,7 @@ protocol layer; crate-level vocabulary is producer/consumer.
 
 ```
 alksocks (default — wasm-clean)
-├── alkcall 0.9.0   (core types: Connection, ProtocolHandler, BiStream,
+├── alkcall 0.10.0  (core types: Connection, ProtocolHandler, BiStream,
 │                    AuthContext, Identity, AccessControl, OwnershipProvider;
 │                    channels: ChannelCore/ChannelClient,
 │                    register_openable_with_establisher, pump_bidi,
@@ -135,7 +135,7 @@ alksocks (local feature) — non-wasm by design
     the first-party local backends + front doors
 
 alksocks (composed feature)
-└── adds: alktunnels 0.3.0 (the direct op egress; the bind-first
+└── adds: alktunnels 0.4.0 (the direct op egress; the bind-first
     listen accept; ADR-008's composed providers) — its default
     crate is wasm-clean; the composed providers use only the
     ungated channels surface (verify with the wasm check)
@@ -156,7 +156,7 @@ differential-testing behavioral reference.
 |---------|----------|------|
 | *(default)* | the RFC 1928 core (`src/rfc1928/`, ADR-013 — codecs, typestate), wire codec, open-op spec, the three seams' traits/types, producer + consumer session types — protocol only; zero kernel-net code, wasm-clean by construction | yes |
 | `local` | the crate's first-party local backends: TCP dial, UDP egress socket, BIND `TcpListener` accept, the front doors (consumer + producer local shapes); brings `tokio/net` + `socket2` into the graph | no (build error on wasm, the alktty posture) |
-| `composed` | the composed providers over alktunnels 0.3.0: direct-op egress (lazy destination→tunnel table), bind-first listen accept — adds the alktunnels dep | yes (alktunnels' default crate is wasm-clean; the composed providers use only its ungated channels surface — verify with the wasm check at implementation) |
+| `composed` | the composed providers over alktunnels 0.4.0: direct-op egress (lazy destination→tunnel table), bind-first listen accept — adds the alktunnels dep | yes (alktunnels' default crate is wasm-clean; the composed providers use only its ungated channels surface — verify with the wasm check at implementation) |
 
 ## Module Map