feat(producer): the forwarded-op establisher variant — ForwardedGate + register_tunnel_forwarded_openable_with_establisher

Implements plan 003 W1's API item (ADR-008 Amendment 2, task
tunnels/corrmiss-forwarded-gate): the assembly-injected correlation
gate wrapped into the alkcall OpenEstablisher dance for the forwarded
op's serving half.

- ForwardedGate: sync gate closure over the parsed
  TunnelForwardedParams; a gate Err → typed channel:open_failed
  before the channel is born (no phantom channel)
- register_tunnel_forwarded_openable_with_establisher: reuses
  make_forwarded_op_handler unchanged (additive-only; the base
  registration stays byte-for-byte compatible as the
  compatibility + residual-race-fallback posture)
- ForwardedPlan: empty marker plan payload (typed-opaque posture,
  payload choice pinned); no reply-field contribution
- Establisher parse failure maps TunnelEstablishError::HandlerError
  → channel:open_failed (deliberately pinned improvement over the
  base shape's silent birth-teardown for malformed ingress); gate
  errors pass through the existing From<TunnelEstablishError> table
  (no new variants; stale token = unknown_resource); timeout: None;
  wrapper order (schema → ACL → allocate → establisher → handler)
  pinned in the establisher doc
- Two-shape posture doc updates: make_forwarded_op_handler's
  correlation-miss block, register_tunnel_forwarded_openable's doc;
  wire.md §The Forwarded Op + tunnel_forwarded_spec() doc synced
  per Amendment 2's "syncs with the API task's in-code doc updates"

Verification: cargo test (85 green, existing suite untouched);
clippy --all-targets -D warnings (native + wasm32); cargo fmt --check;
cargo doc --no-deps (0 warnings); --all-features test run green

docs/architecture/wire.md

@@ -153,7 +153,12 @@ PRODUCER opens a channel back toward the listen-opener side. The
 producer *calls* the op (the opener SERVES it — the ADR-047 §5
 connection-owner rule: the serving side allocates the `channel_id`,
 the producer-side initiator adopts). `Sub`-typed, ALPN marker
-`alk/tunnel`; no establisher (the data plane starts immediately).
+`alk/tunnel`; the serving side registers establisher-less by base
+shape (the data plane starts immediately) or — the recommended shape,
+ADR-008 Amendment 2 — with the correlation-gate establisher variant
+(a stale/missing token then fails the op as a typed
+`channel:open_failed` with `details.reason = "unknown_resource"`; the
+wire vocabulary is unchanged by the amendment).
 Scope gate (opener side): `["tunnel:forwarded"]`
 (`TUNNEL_FORWARDED_SCOPE`) — ingress, a separate grant from
 `tunnel:open`/`tunnel:direct` (ADR-006 Amendment 1).