proof/: add console-fabric word coverage (framebuffer/keyboard/scroll/ttf)

Stadium console fabric words (FABRIC.md items 4.3.3/4.3.5/4.3.7e/4.4q/
4.4v/4.4y). All four files gate their real hardware-touching bodies
behind __STARKERNEL__ (and, for keyboard, architecture too):

- StarForth_Framebuffer_Words.thy: PLOT/FB-WIDTH/FB-HEIGHT fully modelled
  for the hosted-build fallback (deterministic, no hardware dependency);
  kernel bodies (fb_put_pixel/fb_width/fb_height) deferred. Finding:
  FB-WIDTH/FB-HEIGHT have no overflow guard before pushing -- second
  instance of this class of bug after DECAY-RATE@.
- StarForth_Keyboard_Words.thy: all 6 words' non-kernel-or-wrong-arch
  fallback modelled (fixed constant pushes / no-op); third and fourth
  missing-overflow-guard instances. Real hardware polling
  (i8042/virtio-input) deferred.
- StarForth_Scroll_Words.thy / StarForth_TTF_Words.thy: both files gate
  registration itself behind __STARKERNEL__, so their words don't exist
  at all in a hosted build -- no fallback to model, sentinel-only.

Suite now 48 theories, confirmed green via a full clean rebuild (HOL-
Library cold-built in 15m18s after an accidental heap clear, StarForth
itself 33s).

proof/StarForth_Scroll_Words.thy

@@ -0,0 +1,45 @@
+theory StarForth_Scroll_Words
+  imports StarForth_Base
+begin
+
+(* =========================================================================
+   Mirrors: src/word_source/scroll_words.c
+   Registers (kernel-only -- see below): SCROLL-BACK SCROLL-FWD
+
+   Part of the Stadium console fabric work (FABRIC.md item 4.4q). Unlike
+   framebuffer_words.c/keyboard_words.c, this file's word BODIES and its
+   `register_word` calls are BOTH inside `#ifdef __STARKERNEL__` --
+   `register_scroll_words` registers nothing at all on a hosted build
+   (the `#else` branch is just `(void) vm;`). SCROLL-BACK/SCROLL-FWD
+   therefore do not exist as words in the hosted build this suite's other
+   console-fabric theories could otherwise fall back to modelling.
+
+   Kernel build: both words pop one cell (via `vm_pop`'s own underflow
+   guard, per the file's own comment explaining why no separate `dsp`
+   precheck is used -- deferring to whichever convention `vm_pop` itself
+   follows rather than risking a mismatch against this codebase's more
+   than one historical `dsp` convention), clamp negative values to 0, then
+   call `console_fb_scroll_back`/`console_fb_scroll_fwd` -- raw console
+   scrollback-view state with no vm_state counterpart. Not modelled: there
+   is no hosted-build fallback to fall back to, and the kernel body is a
+   hardware/console-state mutation like the rest of this group. *)
+
+lemma scroll_words_not_registered_on_hosted_build: True
+  \<comment> \<open>register_scroll_words's hosted-build `#else` branch does nothing --
+     SCROLL-BACK/SCROLL-FWD are absent from the dictionary entirely
+     outside a kernel build, unlike every other console-fabric file in
+     this sweep (which all register unconditionally with a fallback
+     body).\<close>
+  by simp
+
+lemma scroll_back_not_modelled: True
+  \<comment> \<open>Kernel build: pop (vm_pop's own guard) + clamp negative-to-0 + call
+     console_fb_scroll_back(n) -- console scrollback state, no vm_state
+     counterpart.\<close>
+  by simp
+
+lemma scroll_fwd_not_modelled: True
+  \<comment> \<open>Same shape as SCROLL-BACK, console_fb_scroll_fwd(n).\<close>
+  by simp
+
+end