feat: end-to-end suite — 18-test consolidation over the shared harness

- tests/end_to_end.rs: 1 MiB backpressure, deadline→timeout (ADR-049 §2),
  CF-006 witness (transport + token), odd-ID asserts + distinctness
  (ADR-047 §5), full CF-005 precedence chain (ServingConfig override,
  distinct-id token probe, fail-closed), R-01 concurrency ×3, listen
  FIFO + typed-error table, datagram batching + 7-byte chunk-split
  codec probe + reverse codec session + TCP/UDP concurrent, teardown
  matrix arms (close-with-pump / join copy counts / Drop-with-pump /
  failed-adopt), no-phantom-channel + R-02 data-plane-tracking asserts
- tests/harness.rs: RegistrationMode::Timeout (hanging establisher,
  per-registration bound), wire_serving_identity (CF-005 (a) shape)
- task doc: status completed, notes + summary

Verified: cargo test (68), cargo test --features local (75), 3×
repeat-run clean both configs, clippy -D warnings (all-targets, local,
wasm32), fmt --check, wasm32 check

tests/harness.rs

@@ -97,6 +97,11 @@ pub struct Topology {
 pub enum RegistrationMode {
     Dial(alktunnels::producer::DialFn),
     Listen(alktunnels::producer::AcceptFn),
+    /// A hanging establisher registered with an explicit
+    /// per-registration establishment timeout (the deadline-expiry
+    /// probe — ADR-049 §2's bound override; the open fails with reason
+    /// `timeout` and no channel survives).
+    Timeout(std::time::Duration),
 }
 
 pub async fn wire_with(
@@ -214,6 +219,35 @@ pub async fn wire_with(
             )
             .expect("register tunnel listen openable");
         }
+        RegistrationMode::Timeout(timeout) => {
+            // The deadline-expiry probe's registration shape: a hanging
+            // establisher (never resolves) with an explicit per-
+            // registration timeout. The generic channel ops registered
+            // above on the SAME registry are unaffected (per-op
+            // timeout, ADR-049 §2).
+            let core = alkcall::channels::operations::ChannelCore::new(
+                producer_client.manager().clone(),
+                alkcall::channels::policy::default_policy(),
+            );
+            core.register_openable_with_establisher(
+                alktunnels::params::tunnel_open_spec(),
+                Some(Arc::new(|_input: serde_json::Value, _auth| {
+                    Box::pin(async {
+                        tokio::time::sleep(std::time::Duration::from_secs(3600)).await;
+                        unreachable!("hanging establisher must be timed out, not resolve")
+                            as Result<
+                                alkcall::channels::operations::Establishment,
+                                alkcall::channels::operations::EstablishmentError,
+                            >
+                    })
+                })),
+                alktunnels::producer::make_tunnel_pump_handler(),
+                &producer_op_registry,
+                AuthContext::anonymous(b"alk/tunnel"),
+                Some(timeout),
+            )
+            .expect("register hanging establisher");
+        }
     }
     let producer_client = Arc::new(producer_client);
 
@@ -244,6 +278,26 @@ pub async fn wire(registry: ResourceRegistry, dial: alktunnels::producer::DialFn
     .await
 }
 
+/// A topology with the consumer's transport identity REPLACED by the
+/// serving-side override (`ServingConfig.identity` — CF-005 (a) probe
+/// shape) or stripped entirely (the fail-closed probe). The transport
+/// identity still rides the dialing connection; the override is what
+/// the serving dispatch resolves (the witness proves which one won).
+pub async fn wire_serving_identity(
+    registry: ResourceRegistry,
+    dial: alktunnels::producer::DialFn,
+    override_identity: Option<Identity>,
+) -> Topology {
+    wire_with(
+        registry,
+        RegistrationMode::Dial(dial),
+        Some(consumer_identity()),
+        override_identity,
+        Arc::new(alkcall::core::auth::NoopIdentityProvider),
+    )
+    .await
+}
+
 /// The listen topology (shape 2): the producer's establisher pops
 /// accepted handles from the assembly-fed [`AcceptQueue`] instead of
 /// dialing. Same identity posture as [`wire`].