feat: implement ADR-007 subscription transport — PendingRequestMap.subscribe(), CallHandler dispatch, SSE AsyncGenerator handlers

Add remote subscription support so spokes can consume streaming operations
over pubsub transports (WebSocket, Redis). Extract checkAccess to access.ts
to break circular dep between call.ts and subscribe.ts.

docs/architecture/api-surface.md

@@ -1,6 +1,6 @@
 ---
-status: draft
-last_updated: 2026-05-11
+status: stable
+last_updated: 2026-05-16
 ---
 
 # API Surface