feat: allocation moves into the channels establisher (alkcall 0.6.0 / review 007 R-01) — bump to 0.3.0

- Bump alkcall 0.5.0 -> 0.6.0 (Establishment plan payload, ADR-049
  amendment 2); alktty 0.2.0 -> 0.3.0 (breaking channels-path
  allocation-failure shape)
- make_tty_establisher runs backend.allocate; failure maps to
  EstablishmentError::DialFailed (channel:open_failed reason
  dial_failed); the TtyHandle crosses to the pump handler via a
  private per-open AllocatedHandle one-shot slot (the handle is not
  Sync — it cannot be the ChannelPlan directly)
- make_tty_open_handler gains the Option<ChannelPlan> parameter; a
  plan drives the new drive_session_pre_allocated (pumps only), a
  None plan falls back to drive_session_pre_negotiated (inline
  validate-and-allocate — defense-in-depth for no-establisher
  registrations)
- tty_open_spec's channel:open_failed ErrorDefinition declares
  dial_failed (four reachable reasons)
- Pinned in-band allocate test flipped:
  allocate_failure_fails_open_as_dial_failed (end-to-end, no channel
  survives); establisher unit gate for the plan slot + failure
  mapping
- ADR-010 amended (§2A; §2 kept as historical record), tty-adapter.md,
  session/channels/adapter docs, CHANGELOG, AGENTS.md alkcall pin
  updated

Verification: cargo test (113) + --all-features (137), clippy
-D warnings (native + wasm32, default + all-features), fmt, doc,
wasm32 check — all clean

CHANGELOG.md

@@ -4,6 +4,43 @@ All notable changes to this crate are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this crate adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.3.0] - 2026-09-07
+
+The alkcall 0.6.0 adoption (review 007 R-01 — the `Establishment`
+plan payload): backend allocation moves into the channels establisher.
+Breaking on the channels path's allocation-failure shape; the wire
+format, the direct-ALPN path, and the `TtyBackend` trait are
+unchanged.
+
+### Changed
+
+- **BREAKING — `alkcall` bumped to 0.6.0; channels-path allocation
+  failure changes shape (ADR-010 §2A).** alkcall 0.6.0 filled the
+  reserved `Establishment` field (`plan: Option<ChannelPlan>`,
+  review 007 R-01), so `backend.allocate` moved from the pump handler
+  into the establisher — the allocated `TtyHandle` crosses to the
+  handler via the plan payload (a private per-open one-shot slot; the
+  handle is not `Sync`). Allocation failure now fails the open op
+  itself: `TtySessionError::ChannelsOpen(CallFailed{
+  channel:open_failed, reason: "dial_failed" })` instead of the
+  post-open in-band `NegotiationRejected{ "allocate_failed" }`. The
+  SSH contract now covers every failure class: no channel ever exists
+  opener-side, no `channel_id`, no `0x00`-prefixed in-band frame. The
+  direct-ALPN path's in-band vocabulary (including `allocate_failed`)
+  is unchanged.
+- `tty_open_spec()`'s `channel:open_failed` `ErrorDefinition` declares
+  `dial_failed` in the `details.reason` enum (four reachable reasons:
+  `dial_failed` / `unknown_resource` / `handler_error` / `timeout`).
+- Handler closures in `make_tty_open_handler` gain the
+  `Option<ChannelPlan>` parameter (alkcall 0.6 `OpenHandler` shape);
+  a `None` plan (no-establisher registration) falls back to the
+  pre-0.3.0 inline validate-and-allocate — defense-in-depth, keeping
+  the in-band error-frame vocabulary for that registration shape.
+- New tests: establisher unit gate for allocate-in-establisher (plan
+  slot carries the live handle; failure maps to `dial_failed`), the
+  end-to-end `dial_failed` open-failure surface (flipped from the
+  pinned in-band test), and the handler's `plan: None` fallback arm.
+
 ## [0.2.0] - 2026-09-06
 
 The alkcall 0.5.0 adoption (ADR-049 — review 006 E-01/N-1): the