feat: producer-open-op — establisher + pump handler + registration

- tunnel_establisher: registry lookup -> injected DialFn (ADR-004) ->
  Establishment::new(plan) (R-01 plan flow); typed reason table
  (unknown_resource/dial_failed/resource_shortage/handler_error)
- make_tunnel_pump_handler: accept_bi + plan downcast + pump_bidi
  awaited inline (R-02; no spawn-and-forget, no substrate types)
- register_tunnel_openable: spec + establisher + pump + dial + CF-006
  identity witness seam
- TargetHandle +Sync halves (F-1 bound); Substrate + Hash for registry
  keys; tunnel_establisher_with_witness for the per-call identity probe
- tests: duplex harness (reverse-POC topology) + 11 integration tests —
  round-trip, typed errors, FORBIDDEN fail-closed, CF-005 precedence +
  CF-006 witness, plan-flow concurrency (no race), W2 late
  registration, INVALID_INPUT schema rejection, both-sides sanity

Verified: cargo test (14 unit + 11 integration), clippy -D warnings
(native + wasm32), fmt --check, wasm32 check — all clean

tasks/tunnels/producer-open-op.md

@@ -1,7 +1,7 @@
 ---
 id: tunnels/producer-open-op
 name: Producer half — establisher (dial shape) + pump handler + register_tunnel_openable
-status: pending
+status: completed
 depends_on: [tunnels/params, tunnels/wire-codec]
 scope: broad
 risk: high
@@ -97,16 +97,16 @@ late-registration visibility, pump round-trip through `pump_bidi`.
 
 ## Acceptance Criteria
 
-- [ ] Establisher: typed reason mapping exact (ADR-001's table)
-- [ ] Pump handler: `pump_bidi` inline; no spawn-and-forget; no
+- [x] Establisher: typed reason mapping exact (ADR-001's table)
+- [x] Pump handler: `pump_bidi` inline; no spawn-and-forget; no
       substrate types leak into the handler
-- [ ] `register_tunnel_openable` wires spec + establisher + pump +
+- [x] `register_tunnel_openable` wires spec + establisher + pump +
       dial injection
-- [ ] Integration tests: forward AND reverse topology (the harness
+- [x] Integration tests: forward AND reverse topology (the harness
       shapes from both POCs), ≥8 tests covering the above
-- [ ] Clippy/fmt clean; wasm32 check passes (dial closures are
+- [x] Clippy/fmt clean; wasm32 check passes (dial closures are
       runtime-injected — the crate compiles without `local`)
-- [ ] `cargo test` green
+- [x] `cargo test` green
 
 ## References
 
@@ -118,8 +118,49 @@ late-registration visibility, pump round-trip through `pump_bidi`.
 
 ## Notes
 
-> Agent fills during implementation.
+- Ported from the reverse POC's producer.rs (the 0.7.0-idiomatic plan
+  flow, R-01) with the crate generalizations:
+  - The dial closure is INJECTED (`DialFn`) — the POC had real socket
+    code inline (tokio TCP/UDP); the crate's establisher is
+    substrate-agnostic and the `local` feature (or the assembly layer)
+    supplies the closure (ADR-004's inversion point, tested via
+    in-process duplex echo + failing dials).
+  - `register_tunnel_openable` takes `dial` + `identity_witness` (the
+    CF-006 probe seam) — the POC's registration closure had no dial
+    injection.
+  - `ResourceRegistry` keys on `(String, Substrate)` (the enum, not a
+    &'static str — `Hash` added to `Substrate`).
+  - `TargetHandle` carries `+ Sync` halves (the F-1 plan-payload
+    bound).
+- Harness (tests/harness.rs): the reverse POC's topology (producer =
+  `from_connection_with_serving` on the connect side, consumer =
+  ChannelsAdapter + capturing install hook) with the dial closure
+  standing in for sockets. The consumer drives the open op via
+  `call_with_payload` on channel 0 and adopts the producer-allocated
+  ID.
+- 11 integration tests: round-trip through `pump_bidi` (wrapper reaps
+  the producer channel on pump completion — R-02), unknown_resource +
+  dial_failed typed errors (no phantom channel either side), FORBIDDEN
+  identity-less (fails closed), transport-identity open (CF-005 (b)),
+  token precedence (CF-005 (a) + the CF-006 witness), same-resource
+  concurrency (no plan race), late registration (W2), unknown
+  substrate schema rejection (INVALID_INPUT — the registry's
+  schema-validation runs before the establisher), outbound-calls-
+  resolve-while-serving (ADR-022 §2), substrate-keyed registry lookups.
+- alkcall 0.7.0 note: the establisher's per-call `auth` carries the
+  dispatch-resolved identity (CF-005 corollary) — the witness proves
+  the overlay; `INVALID_INPUT` is the wire code for a schema failure
+  (distinct from `channel:open_failed` establishment failures).
+- `futures` crate used for `BoxFuture` in `DialFn` (already a dep).
 
 ## Summary
 
-> Agent fills this on completion.
+Producer half complete: dial-shape establisher (registry lookup →
+injected dial → `Establishment::new(plan)`), the substrate-agnostic
+pump handler (`pump_bidi` awaited inline, R-02), and
+`register_tunnel_openable` (spec + establisher + pump + dial
+injection + witness). 14 unit tests (params + codec) + 11 integration
+tests over the duplex harness pass. Verified: cargo test, clippy
+--all-targets -D warnings (native + wasm32), fmt --check, wasm32
+check — all clean. The listen establisher variant lands with
+`tunnels/producer-listen`.