"Can a host from a small 3-node vSAN cluster be converted to participate as a witness of a now 2-node vSAN cluster?"
Sure, provided the hardware is supported for the version of ESXi in use - hardware Witness vs appliance has pros and cons: the main of each being that it requires an ESXi license (any that allow it to be connected to a vCenter), it is permissible to run other VMs/workloads on it (not on vsanDatastore).
"Also, what role would a vSAN witness would play on cluster that already has enough nodes not to need one? Is that just an ESXi server doing nothing?
Witnesses are used ONLY in Stretched or ROBO clusters and ONLY store witness components (16MB component per Object) - thus are used in specific cluster layouts as their own Fault Domain, e.g. you can't just add a Witness node to a non-stretched cluster (and I don't know why one would want to).
It hasn't been long when I reenabled vSAN, maybe two months; I read the docs before that and somehow misinterpreted the stretched part of it as a deployment option/feature, not as the norm.
And just now I was laying down fumbling with vCenter on the tight interface it has on an iPad and I landed just in there. :/ It's odd how vSAN won't let you start without meeting spec but once it's up the rules bend rather wildly, it's odder still that that's exactly the opposite for 1-node clusters.
Thanks for the info, I'm considering upgrading to 7 and I'm soaking up everything I can to pick the correct SKU.