videre-host: document the handshake admission-check boundaries (vacuous opt-out + post-instantiation export check)

[mfw78]

From review of #448 (review). Confirmed still valid at HEAD. Doc-only, non-blocking. Target: L2 videre-host.

Two admission-check boundaries in the venue handshake are undocumented and read misleadingly from the docs alone:

1. Vacuous opt-out (handshake.rs, admit_worker / admit_provider): a keeper whose manifest omits the [venue] section is admitted unconditionally - the check is opt-in, firing only when a keeper declares the section. A sensible backward-compat default for non-venue keepers, but the docs read as if every keeper is checked. State the precondition and that the silent opt-out is intentional (one line).
2. Post-instantiation export check (registry.rs, after VenueAdapter::instantiate_async): the export-vs-manifest divergence check necessarily runs after instantiation (a guest export cannot be called before instantiating), unlike the pre-compile manifest-section predicates in supervisor.rs. A buggy or malicious adapter therefore fully instantiates - and any instantiation side effects run - before this specific check catches the mismatch. Note that only the manifest-section predicates are pre-compile; this export check is post-instantiation, pre-init (one line).

Acceptance criteria

• admit_worker / admit_provider document the opt-in precondition.
• The registry export-divergence check documents its post-instantiation, pre-init ordering.

[mfw78]

Landed via #533 (squash-merged into dev/m1 as a5573a3). Closing manually since the merge target is not the default branch.