videre-host: document handshake admission boundaries

[mfw78]

What

Doc-only change in crates/videre-host recording two admission-boundary facts that the code already enforces but did not spell out.

handshake.rs: a terse "Opt-in" rustdoc line on both admit_provider and admit_worker stating that a manifest omitting [venue] is admitted unconditionally, an intentional silent opt-out for non-venue keepers.

registry.rs: a comment before verify_exported_versions (after VenueAdapter::instantiate_async) noting it runs post-instantiation, pre-init, so unlike the pre-compile manifest-section predicates in supervisor.rs a buggy or malicious adapter fully instantiates, running any instantiation side effects, before this divergence check catches the mismatch.

No code behaviour changed.

Why

Both boundaries are load-bearing but non-obvious. The vacuous admit on absent [venue] reads like a missing check rather than a deliberate opt-out, and the export-divergence check's ordering relative to instantiation determines whether adapter side effects can run before the mismatch is caught. Documenting them in place keeps the security-relevant intent next to the code that realizes it.

Testing

cargo fmt --all -- --check clean, and cargo clippy -p videre-host --all-targets --all-features -- -D warnings clean after a cold rebuild of the crate. Both run under nix develop (rustc 1.94.0). The vacuous opt-out is backed by the existing undeclared_sections_are_admitted test; the ordering note matches verify_exported_versions running after instantiate_async and before call_init.

AI Assistance

Implemented, reviewed and verified with Claude Code (Opus).

Closes #519