docs(wit): document capability and component contracts

components/wasi-clock-probe/src/lib.rs

@@ -1,4 +1,12 @@
+//! Fixture proving that ambient WASI clock imports are denied by the sandbox.
+//!
+//! Calling `std::time::Instant::now` causes this Component to import WASI
+//! monotonic-clock directly. Wasmeld only links explicitly approved capability
+//! packages, so registration or startup must reject this fixture.
+
 mod bindings {
+    // The declared service WIT contains no WASI clock capability; the direct
+    // standard-library use below deliberately creates an undeclared import.
     wit_bindgen::generate!({
         path: "wit",
         world: "wasi-clock-probe-component",