runtime: build the videre-host crate and register the venue platform

[mfw78]

Closes #381

What

Adds the videre-host extension crate and moves the venue-adapter bindgens, VenueRegistry, EgressGuard, and the keeper-facing videre:venue/client interface out of nexum-runtime into it, registered as one extension via videre_host::platform(&config). Grows the runtime's Extension seam with extension-declared subscription kinds and attribute-filtered event streams (Extension::subscriptions/Extension::events, EventSources, ExtensionEvent), and threads config into Runtime::extensions. shepherd now composes the videre platform alongside the cow-api extension.

Why

Nothing owned the venue-adapter ProviderKind, the un-privileged registry, the advisory guard, or the client bindgens as an installable extension. Landing them in videre-host makes venue support a plug-in rather than a welded-in host concern, and proves the seam by moving the intent-status poll source through it instead of a bespoke runtime loop.

Closes #381

Testing

• cargo fmt --all --check
• cargo check --workspace --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo nextest run --workspace --all-features (includes videre-host's platform integration suite: install/service/provider wiring, capability linking, status-poll dispatch)
• cargo test --doc

AI Assistance

Implemented with Claude Code end-to-end; human-reviewed before opening.

[lgahdl]

Faithful, well-executed move for a diff this size — the registry.rs relocation is 95% import/doc/logging churn with the actual submit() body, the quota-before-guard ordering (#435), and the liveness/sweep integration (#445) all untouched, and the new subscription/event seam correctly reproduces the old bespoke poll loop's cadence and gating (venue_count() == 0 / subscribed.contains(kind) double-gate, empty-filter-set vacuous match-all). Comments are unusually clean for a refactor this size — no stale references to the old paths found anywhere. A few smaller notes:

• The PR body says HostState.pool_router is deleted, but pool_router doesn't appear anywhere in this diff — that field was already removed in an earlier PR (#443), so this line in the description is stale copy, not a functional claim to verify here.
• The new subscription/event seam (Extension::subscriptions/events, EventSources, ExtensionEvent) is mechanically generic, but videre-host is still its only real consumer — cow-api doesn't use it. "Proves the seam" is proven by construction, not by a second independent user, and nothing detects two extensions accidentally choosing the same kind string (they'd silently merge into one vocabulary set). Worth landing or stubbing a second consumer before leaning on this as validated-general infrastructure.
• Test coverage: I didn't find a platform-level regression test for quota-before-guard ordering or the watch-set cap/expiry (#438) in the new videre-host/tests/platform.rs — the underlying unit tests moved intact inside registry.rs, so behavior is covered, but the E2E-level platform suite doesn't re-exercise either. Worth confirming that's an accepted gap rather than an oversight.

[mfw78]

Checked the three body notes against the end-of-train state.

1. Stale pool_router line - fixed. Correct: HostState.pool_router was removed back in #443, not here. I have dropped that clause from the PR description; it was stale copy, not a functional claim.

2. Event/subscription seam (single consumer + no duplicate-kind detection) - still valid, tracked in #517. At the tip, subscription kinds still aggregate into a BTreeSet<String> with no collision check, so two extensions choosing the same kind would silently merge, and videre-host is still the only consumer. Filed as a hardening follow-up: detect a duplicate kind at boot (the way HostServices::from_extensions already bails on a duplicate service namespace), plus optionally a second consumer to validate generality.

3. Platform-level test coverage - accepted gap. The quota-before-guard (#435) and watch cap/expiry (#438) unit tests moved intact into registry.rs, so behaviour stays covered; the platform.rs E2E suite is scenario-level and does not re-exercise them. That is an accepted gap rather than an oversight - happy to add platform-level regressions as a small follow-up if you want belt-and-suspenders.