feat: params — TunnelParams/Substrate wire types + tunnel_open_spec

- TunnelParams {resource, substrate} with deny_unknown_fields (ADR-001
  loud-rejection posture); Substrate enum ships unix in v1 (OQ-TN-14)
- tunnel_open_spec(): channels/tunnel/sub, Sub-typed, alk/tunnel
  channel-open marker, input schema enum [tcp,udp,unix], channel_id
  output schema (minimum 1, required), tunnel:open ACL (ADR-006),
  discovery description
- establishment_reason delegates to alkcall 0.7.0's typed
  ChannelOpenError::establishment_reason; error re-exported through
  params
- 6 unit tests: serde round-trip, unknown/missing-field rejection,
  unknown-substrate rejection, spec conformance to wire.md

Verified: cargo test, clippy --all-targets -D warnings (native +
wasm32), fmt --check, wasm32 check — all clean

tasks/tunnels/params.md

@@ -1,7 +1,7 @@
 ---
 id: tunnels/params
 name: TunnelParams + open-op spec (schema, scope gate, constants)
-status: pending
+status: completed
 depends_on: [tunnels/crate-init]
 scope: narrow
 risk: low
@@ -73,16 +73,16 @@ errors (filled incrementally by later tasks); plus the re-export of
 
 ## Acceptance Criteria
 
-- [ ] `TunnelParams` round-trips serde; unknown fields rejected
-- [ ] `tunnel_open_spec()` matches wire.md §The Open Op exactly (op id,
+- [x] `TunnelParams` round-trips serde; unknown fields rejected
+- [x] `tunnel_open_spec()` matches wire.md §The Open Op exactly (op id,
       type, ALPN marker, schemas, ACL, description)
-- [ ] Schema validation test: valid params pass; missing fields,
+- [x] Schema validation test: valid params pass; missing fields,
       unknown fields, unknown substrate values all fail
-- [ ] `establishment_reason` maps `channel:open_failed` details.reason
+- [x] `establishment_reason` maps `channel:open_failed` details.reason
       (POC-pinned shapes: `unknown_resource`, `dial_failed`,
       `resource_shortage`)
-- [ ] Unit tests cover the serde + schema shapes
-- [ ] wasm32 check passes
+- [x] Unit tests cover the serde + schema shapes
+- [x] wasm32 check passes
 
 ## References
 
@@ -95,8 +95,32 @@ errors (filled incrementally by later tasks); plus the re-export of
 
 ## Notes
 
-> Agent fills during implementation.
+- `TunnelParams` + `Substrate` per the task's exact type shapes
+  (`deny_unknown_fields`, `rename_all = "lowercase"`, `Unix` in the
+  enum). `Eq` added to `TunnelParams` (test equality).
+- `tunnel_open_spec()` lives in params.rs per the module map;
+  producer.rs re-exports. Output schema pins `channel_id` with
+  `minimum: 1` + `required` (wire.md: integer > 0) — the POC's
+  `minimum: 0` / no-required was loose.
+- `establishment_reason` delegates to alkcall 0.7.0's
+  `ChannelOpenError::establishment_reason` method (upstream has it);
+  `ChannelOpenError` re-exported from params.rs (pub use, since lib.rs
+  re-exports through it).
+- Schema-validation tests use the `TunnelParams` deserializer as the
+  enum validator (same deny-unknown/enum posture as the registry's
+  JSON Schema check; no jsonschema dep added for v1 — the
+  input_schema string is asserted structurally in
+  `open_spec_matches_wire_md`).
+- 6 unit tests: round-trip ×3 substrates, unknown-field rejection,
+  missing-field rejection, unknown-substrate rejection, spec-shape
+  conformance, schema enum validation.
 
 ## Summary
 
-> Agent fills this on completion.
+`src/params.rs` complete: the wire-stable `TunnelParams`/`Substrate`
+types (ADR-001 exact shapes), `tunnel_open_spec()` (op id, Sub type,
+External visibility, input/output schemas with the 3-value substrate
+enum, `tunnel:open` ACL, channel-open marker, description),
+constants, and the `establishment_reason` helper. Verified: `cargo
+test` (6 passed), clippy --all-targets -D warnings (native + wasm32),
+fmt --check, wasm32 check — all clean.