docs: clarify diff connection routing

[kvlonge]

Why

Direct target diffs use one execution session. The documentation previously implied that both target connections were resolved, obscuring which credentials are required.

Changes

• document that FROM and TO identify relation namespaces
• identify the TO target connection as the sole execution connection
• state that the connection must be able to read both fully qualified namespaces

Verification

• validated docs.json
• git diff --check
• public-repository hygiene scan