docs: add ADR-009 (open op's input is the negotiation); fix stale doc refs

Review of the 2026-09-05 session commits:

- the ADR-009 decision cited by 96692d3 and docs/reviews/001 was never
  written — added decisions/009-channels-open-op-is-the-negotiation.md
  (context: the L1 two-gate disagreement, alkcall 0.4.0/0.4.1
  prerequisites, producer/consumer design, consequences, door type)
- channels.rs module doc + register_openable doc still described the
  old wire-frame negotiation read (drive_session) — aligned with
  drive_session_pre_negotiated and the enforced input schema
- tty-adapter.md: session-driver section + ADR tables now reference
  ADR-009 and the pre-negotiated driver; overview.md ADR index row

Verification: cargo test 93 lib (default) / 136 (--all-features);
clippy -D warnings native + wasm clean; fmt clean; doc 0 warnings.

src/channels.rs

@@ -13,10 +13,10 @@
 //! respond with `{ channel_id }`. The `TtyOpenHandler` receives the
 //! channel's `Connection` (data-plane ALPN `alk/tty`), calls
 //! `accept_bi()` to get the channel's `BiStream`, and runs
-//! [`crate::adapter::drive_session`] on it — the same code path the
-//! direct-ALPN `TtyAdapter` uses (ADR-093: TTY always uses its 5-byte
-//! format; the channels layer strips its 8-byte header and hands TTY
-//! the payload transparently).
+//! [`crate::adapter::drive_session_pre_negotiated`] on it — the same
+//! three-pump session driver as the direct-ALPN path, minus the
+//! wire-frame negotiation phase (the open op's `input` is the
+//! negotiation, ADR-009).
 //!
 //! The access control (scope-gate + ownership) is wired into the
 //! `OperationSpec`'s `AccessControl` and enforced by the registry's
@@ -65,9 +65,10 @@ pub const TTY_ALPN: &str = "alk/tty";
 /// this helper. The helper builds the [`OperationSpec`] for
 /// `channels/tty/sub` with the `channel_open` marker set
 /// (`ChannelOpenSpec::new("alk/tty")`), an `AccessControl` carrying
-/// the `tty:open` scope gate, and a permissive input schema (the
-/// `NegotiateRequest` shape — JSON, validated by the
-/// `drive_session` negotiation reader). It then wraps the
+/// the `tty:open` scope gate, and the partial `NegotiateRequest`
+/// input schema (`carriage`/`backend`/`cmd` required — alkcall 0.4
+/// enforces it at dispatch; the full parse and semantic validation
+/// runs in the handler). It then wraps the
 /// `TtyOpenHandler` factory and calls
 /// [`ChannelCore::register_openable`].
 ///