videre-host: document VenueRegistry::install mutex discipline and gate it to boot-time

[mfw78]

Follow-up from review of #441 (comment). Confirmed still valid at the end of the M1 to M5 train. Code moved from nexum-runtime to videre-host (L2 nullislabs/videre-nexum-module).

Two small, non-blocking gaps on VenueRegistry::install (now videre-host/src/registry.rs:348):

1. Document the mutex discipline

Nothing on install states it takes the synchronous std::sync::Mutex only for the plain HashMap insert and never holds it across an .await. That is precisely the fact a future reader needs before adding an .await inside the critical section, or when reasoning about deadlock against the async ActorSlot mutex used elsewhere in the same file. Add a line such as:

// Takes the adapter-map mutex only for the synchronous insert; never held across an await.

2. Tighten the visibility

install went from a private builder method (which encoded "install happens before build() freezes self") to a pub method on the shared, cloneable VenueRegistry handle. Nothing calls it post-boot today, but the type no longer distinguishes boot-time install from runtime install, so a future caller holding a clone can register at any point with no compiler signal. Reduce to pub(crate) (or gate it with a boot-only capability/token) until there is a real post-boot use case.

Acceptance criteria

• install carries the mutex-discipline doc line.
• install is pub(crate) or otherwise boot-gated, not pub on the shared handle.

[mfw78]

Landed via #534 (squash-merged into dev/m1 as 7cff3d4). Closing manually since the merge target is not the default branch.