stadium: make VM population bound RAM-derived, not a static array of 4

Replaces STADIUM_MAX_VM_COUNT (Kconfig, hardcoded default 4) with a
boot-time computation, mirroring the pattern stadium_boot_init() already
used for the cell pool. New Kconfig STADIUM_VM_MEMORY_PERCENT (default
50): max_vm_count = (kmalloc_get_stats().free_bytes after the cell array
* STADIUM_VM_MEMORY_PERCENT / 100) / VM_MEMORY_SIZE, floored to 1, no
ceiling (population is not knowable in advance - could be 4, could be
4000). stadium_quotas and word_slots (plus stat_promotions/stat_evictions)
are now kmalloc'd to the computed count instead of declared with a macro.
New accessor stadium_max_vm_count() replaces every STADIUM_MAX_VM_COUNT
reference, including capsule_birth.c's birth-refusal gate.

Two things found and fixed along the way:

- The existing cell-pool budget was sourced from pmm_get_stats(), which
  reflects physical pages PMM hasn't handed to any subsystem yet - but
  the actual allocation is kmalloc(), which draws from the separate,
  fixed-size heap kmalloc_init() (M6) already carved out of PMM before
  stadium_boot_init() ever runs. Budgeting against PMM's leftover and
  allocating from the kmalloc heap are two different pools. Both the
  cell budget and the new VM-count budget now source from
  kmalloc_get_stats() instead.

- stadium_owner[] (which VM's quota owns each cell) was uint8_t, capped
  at 255 slots by a compile-time assert tied to the old macro. Widened
  to uint16_t (65535 slots of headroom) with a runtime clamp + log if
  the computed count ever exceeds that, since there's no ceiling anymore.

Three-arch QEMU acceptance: all clean to ok>, computed VM count genuinely
differs by actual available RAM (amd64/riscv64: 50 slots at -m 1024,
aarch64: 101 slots), Stadium conservation invariant identical across all
three (resident_sum=43691 reservoir=21845 sum=65536).
logs/20260815-080526/amd64, logs/20260815-080826/aarch64,
logs/20260815-080952/riscv64.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/starkernel/vm/stadium_words.h

@@ -47,11 +47,15 @@
 #include "starkernel/vm_uuid.h"
 
 /*
- * stadium_words_init - Zeroes the word_id -> cell_index map (DICTIONARY_SIZE
- * entries per VM quota slot, STADIUM_MAX_VM_COUNT slots, static -- no
- * allocation). Must be called after stadium_boot_init() and
- * stadium_birth_hera(), before any word ever dispatches. Safe to call again
- * (re-zeroes for every slot); nothing does today.
+ * stadium_words_init - Allocates and zeroes the word_id -> cell_index map
+ * (DICTIONARY_SIZE entries per VM quota slot, stadium_max_vm_count() slots,
+ * kmalloc'd -- was a flat static array before 2026-08-15, when the VM count
+ * bound became RAM-derived rather than a compile-time constant). Must be
+ * called after stadium_boot_init() and stadium_birth_hera(), before any word
+ * ever dispatches. NOT safe to call twice -- unlike the old zero-only
+ * version, a second call would kmalloc a second set of tables and leak the
+ * first; guarded internally as a no-op if already initialized. Nothing
+ * calls it twice today.
  *
  * item 4.2 (FABRIC.md §25.5): the map is keyed by quota slot, not just
  * word_id -- word_id is assigned per-VM (vm->next_word_id), not globally