refactor(videre-host): unify quote ledger on runtime wall-clock seam

[mfw78]

What

Reworks the quote-staleness ledger onto the runtime's attach_clock seam (rt#97) instead of the crate-local Clock trait.

• Videre now overrides Extension::attach_clock in lib.rs, forwarding the launch wall clock into VenueRegistry::set_wall_clock.
• The registry's clock is a late-set Mutex<Option<Arc<dyn HostWallClock + Send + Sync>>> slot: the lock serialises installs and the last launch wins, read through ledger_now_ms which falls back to wasmtime-wasi's real WallClock while unset.
• VenueRegistryBuilder::new no longer defaults a crate-local SystemClock; it now defaults wasmtime_wasi::clocks::WallClock. with_clock is kept as a documented test/standalone escape hatch.
• Deletes the crate-local Clock trait and SystemClock, and the auto_impl dependency in videre-host/Cargo.toml used only for that trait's forwarding impls; adds wasmtime-wasi as a direct dependency.
• crates/videre-host/tests/platform.rs: the TestClock fixture in registry.rs's unit tests is replaced with nexum_runtime::test_utils::clock::ManualClock, and two new e2e tests are added, e2e_stale_quote_is_refused_on_the_shared_wall_clock (boots a module through BootScenario with a ManualClock override so the runtime performs the attach_clock call itself, then proves a fresh submit succeeds and a submit past the advanced clock is refused with the stale-quote: prefix) and attach_clock_installs_the_quote_ledger_clock (calls attach_clock directly, no wasm artefact, so the seam stays pinned when the e2e skips).

Why

The registry previously ran its own Clock trait disconnected from the runtime's wall-clock seam, so the ledger and the guest-visible clock could diverge. Wiring attach_clock gives the ledger and guests one shared timeline sourced from the same launch clock, and lets a ManualClock-driven boot exercise the real staleness path end to end instead of only through a registry-local stub.

Closes #42

Testing

All checks ran on a fresh clone of refactor/host-wall-clock-seam at 13605fe, detached, inside nix develop (rustc 1.94.0, cargo-nextest 0.9.127). The only touched crate over origin/chore/qa-sweep-terse-dedup..HEAD is videre-host (plus Cargo.lock).

cargo clippy -p videre-host --all-targets --all-features -- -D warnings   # clean, exit 0
cargo test --doc -p videre-host --all-features                            # 0 passed; 0 failed (crate has no doctests)
RUSTDOCFLAGS='-D warnings' cargo doc --no-deps -p videre-host             # clean, exit 0

No guest crate and no videre-macros change is in the diff, but tests/platform.rs is reworked onto BootScenario, so the wasm-loading suite ran anyway:

just build-modules                                                        # 5 module wasms built, exit 0
cargo nextest run -p videre-host

Red-teamed against the pinned runtime (db39b6c, cloned to /tmp/rt42/rt for the authoritative seam): re-derived ledger_now_ms/record_quote/check_quote_freshness against QUOTE_HORIZON_MS/QUOTE_GRACE_MS and confirmed the new e2e's fresh-submit leg genuinely exercises the shared-clock path rather than passing vacuously; fixes from that pass are folded into 13605fe.

AI Assistance

Implementation by claude-fable-5, red-team review by claude-opus-5, PR description by claude-sonnet-5.