Function register_hosts 

pub fn register_hosts(setup: HostSetup) -> HostRegistry

Registers every host implementation a run may reach, granting exactly setup.grants.

Registering a module does not grant it: HostRegistry::call rejects every call whose capability is missing from the grant set, so registering the full set here and granting a subset is what makes an ungranted call a reported refusal rather than an unknown module.