dep: alktunnels 0.4.1 -> 0.5.0 (the correlation-gate release)

- Additive upstream API only (the forwarded-op establisher variant,
  register_tunnel_forwarded_openable_with_establisher + ForwardedGate);
  no alkcall bump (0.10.1 rides on), no wire change, and no change on
  this crate's paths: our composed accept keeps the base
  register_tunnel_forwarded_openable byte-for-byte.

Verification: cargo test (default + composed: 145/148 lib tests, all
suites green), cargo clippy --all-targets -D warnings (default +
composed), cargo fmt --check, cargo check/clippy wasm32-unknown-unknown.

Cargo.toml

@@ -48,9 +48,9 @@ futures = { version = "0.3", default-features = false, features = ["std"] }
 # The sibling crate (the composed egress's direct-op vehicle — ADR-008/
 # ADR-009): rides `composed` alone. Pinned; bump deliberately
 # (convention 11's deliberate-bump rule applies to siblings too).
-# 0.4.1: the dependency-patch ride on alkcall 0.10.1, no alktunnels
-# API/wire change.
-alktunnels = { version = "0.4.1", optional = true }
+# 0.5.0: the correlation-gate release (the forwarded op's serving half
+# gains an establishment phase — additive API only, no wire change).
+alktunnels = { version = "0.5.0", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1", features = ["full", "test-util", "macros"] }
@@ -58,4 +58,4 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 # The composed suite's topology (the alktunnels direct-op producer) —
 # dev-only: the test binary gates itself on the `composed` feature
 # (`#![cfg(feature = "composed")]`), the dev-dep keeps it compiling.
-alktunnels = "0.4.1"
+alktunnels = "0.5.0"