feat(tunnel): land the route-1 bridge — direct-tcpip + streamlocal served for real (w3-tunnel-direct)

- The route-1 bridge (ADR-006 decision 1, the POC-3 stage-C recipe
  re-landed as contract): per accepted `direct-tcpip` /
  `direct-streamlocal` open, the target/substrate are constructed from
  the SSH open arguments and the spawned task runs
  `TunnelSession::open_direct` over the held `Arc<ChannelClient>` →
  accept only after the fabric open succeeds → `take_halves()` pumped
  against the taken channel (`pump_bidi`) — the open hook returns fast;
  a fabric failure answers the explicit `ConnectFailed` reject (the
  wave-2 stub's reason surviving as the real decline; the stub retired
  from the direct rows, kept on `forwarded-tcpip` for w3-tunnel-listen).
- The cap across the fabric window (recorded): the admission is taken
  at the hook and held across the fabric open; a fabric failure
  releases the count inside the spawned task — the admitted-but-
  rejected shape no `channel_close` can ever fire for. `ChannelCap`
  became a mutex-backed `Arc`: admissions stay packet-loop-only,
  releases have exactly two disjoint sites (close hook, bridge task),
  both saturating.
- The identity ride recorded (the `w2-auth-bridge` parked item): the
  alkhub `hub_leg.rs` one-time-set precedent is a serving-side set; the
  client-side `take_call_connection()` seam is rejected for this door
  (one-shot detach of the shared assembly handle's open surface — a
  fortiori the relay note's "wrong for hubs"); the identity the fabric's
  `AccessControl::check` consults is the dial identity (CF-005), the
  composition is assembly policy, and the door structurally refuses
  anonymous serving (`no-identity`, unreachable on the wire). Upstream
  ask booked for the gate.
- The OQ-11 runtime-Unix gate: `direct-streamlocal` compiles wherever
  `tunnel` compiles; off-Unix a clean open-decline before any fabric
  call (dial-call witness at zero), on-Unix the real bridge.
- Decline classes recorded: policy → `AdministrativelyProhibited`
  (unfeatured/cap/`no-identity`); cannot-bridge → `ConnectFailed`
  (failed fabric open, absent handle under the feature, invalid
  target, off-Unix streamlocal); the event vocabulary gains
  `invalid-target` and `unix-unavailable`.
- The optional dep lands: `alktunnels 0.4.1` (pin re-verified against
  crates.io — max stable, MIT OR Apache-2.0, rust_version 1.88, alkcall
  0.10.1 exact), wired `tunnel = ["dep:alktunnels"]`, `local` never
  enabled.
- The fabric double (`tests/tunnel_mapping.rs`): the POC-3 §C.4
  in-process recipe — `ChannelsAdapter` + `InstallChannelZero` + the
  alktunnels openables + a hand-rolled dial/dial-fail seam (in-process
  duplex targets keyed by the rendered string; the smoke's dial is real
  TCP). Rows: both-substrate serve round trips, fabric-failure,
  cap refusal + release + recovery, the fabric-ACL composed-gate
  witness, the CF-006 identity witness, the OQ-11 gate, and the
  `ssh -L` + curl real-tool smoke (conditional-skip posture, ran green).

Verification: `cargo test` rows green per feature build (default,
tunnel, git, session, git+session, tunnel+git, tunnel+session,
--all-features); `cargo clippy --all-targets -- -D warnings` ×2
(default + --all-features) clean; `cargo fmt --check`; `cargo doc
--no-deps` 0 warnings; `taskgraph validate` (26 tasks).

Cargo.lock

@@ -114,6 +114,7 @@ dependencies = [
  "alkcall",
  "alkgit",
  "alktty",
+ "alktunnels",
  "alkvault",
  "async-trait",
  "bytes",
@@ -150,6 +151,22 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "alktunnels"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee56da894f2d02120d3602df32c7f6a9db7f930a401df66d40b632cd9767af41"
+dependencies = [
+ "alkcall",
+ "bytes",
+ "futures",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.21",
+ "tokio",
+ "tracing",
+]
+
 [[package]]
 name = "alkvault"
 version = "0.1.0"