starkernel: item 4.1a -- quota granting, Hermes's one-time birth grant

Punch list §25 item 4.1a complete.
New prerequisite item, found while scoping 4.2: no quota-granting mechanism
existed at all. Adds stadium_grant_quota(new_vm_id, from_vm_id) -- a
one-time initial grant at birth, distinct from item 1.3's still-unbuilt
recurring capacity-transfer arbitration. Splits the donor's free list evenly
by cell count, reassigns stadium_owner[] for every moved cell, and grants
the new VM a fresh Q48_ONE reservoir (not a split of the donor's -- per-VM
conservation, same pattern as Hera's own boot grant). Wired into every baby
VM's birth in capsule_birth.c.

Verified via a boot-time self-test in kernel_main.c using a synthetic
identity (not the real UUID pool, not a real capsule birth -- item 0.1's
Hera-alone pruning stays intact). All three architectures booted to ok> with
identical output: grant OK, Hera reservoir=0 (already fully committed to
resident words, correctly unchanged), test-vm reservoir=65536 (fresh
Q48_ONE). dict_hash identical across all three and unchanged from item 4.1's
baseline (0x3d4e1daf289da94f) -- confirms no dictionary word was added.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/starkernel/vm/stadium.h

@@ -401,6 +401,35 @@ int stadium_evict(size_t cell_index);
  */
 size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);
 
+/*
+ * stadium_grant_quota - One-time initial quota grant for a newly born VM
+ * (FABRIC.md item 4.1a). NOT item 1.3's recurring capacity-transfer
+ * arbitration -- that mechanism (density-gradient-driven, per capacity-tick)
+ * stays unbuilt and its "how much moves" question stays open. This is the
+ * narrower, one-time event: the same shape as Hera's own whole-pool grant at
+ * stadium_boot_init(), just from an existing VM's free list instead of the
+ * boot-time global one.
+ *
+ * Splits from_vm_id's free list evenly by cell count (new VM gets the first
+ * half by list-walk order; from_vm_id keeps the remainder, including any odd
+ * cell). Reassigns stadium_owner[] for every cell that moves. Touches no
+ * resident cell on either side -- only free-list cells move, so from_vm_id's
+ * residents (including a pinned cell 0, if from_vm_id is Hera) are
+ * unaffected. Grants new_vm_id a fresh Q48_ONE reservoir -- NOT a fraction of
+ * from_vm_id's, since conservation is per-VM (see StadiumVMQuota.reservoir's
+ * doc in stadium.c), not a shared pool split across VMs.
+ *
+ * REFUSES (returns -1, does not crash) if: the Stadium is not initialized;
+ * new_vm_id already holds a quota; from_vm_id holds no quota; from_vm_id's
+ * free list has fewer than 2 cells (nothing to split); or no empty quota
+ * slot remains (STADIUM_MAX_VM_COUNT exhausted).
+ *
+ * @param new_vm_id   The VM receiving a fresh quota. Must not already have one.
+ * @param from_vm_id  The VM whose free list is split. Must already hold a quota.
+ * @return 0 on success, -1 if refused.
+ */
+int stadium_grant_quota(VMUuid new_vm_id, VMUuid from_vm_id);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_VM_STADIUM_H */