"i've heard this before, but note that the documentation for the evaluation set up clearly shows the vShield Manager in the resource cluster, as opposed to the management cluster. Is this a legacy deployment pattern?"
No ... it was a matter of trying to use the fewest number of ESXi hosts.
"I'm surprised that I am allowed to create DRS, as I did, on my cluster if vMotion is working . . . shouldn't there be some sort of a warning here?"
You mean a resource pool? Don't confuse the automation mode (full vs manual) with having DRS enabled/disabled. If you create a cluster of exactly 1 ESXi host, you have to set DRS to manual mode to allow resource pools to exist.
There is no warning if DRS is in Manual Automation mode, since it's doing exactly what it what it thinks is normal ... not moving VMs around.
"Are you saying that even with vMotion functioning, there could be a problem anyway? I only have two hosts in my cluster, perhaps they are going to have a race condition on who can get into maintenance mode first? This would suggest that you couldn't really deploy any vDC onto clusters that currently have vm's on them, right?"
vCloud Director is the one putting all the hosts into maintenance mode at the same time. If you only have 2 hosts, it'll do all hosts. There are some considerations to be had with the "proof of concept" that you are doing since the vShield manager is in the deployment cluster. This issue would be avoided with a non-trial setup.
all that being said ... there are probably still some improvements to be made.