Phase 8 A: virtio-rng entropy source for real Ed25519 signing

The kernel's ed25519_verify() is deliberately verify-only -- no signing,
no keygen, no entropy source. That conflicts with the on-device MINT
word vision (Zuse signing new user certs live at runtime), so this
reopens that constraint on request rather than reshaping MINT around
verify-only.

vm_uuid.h already found the real gap: amd64 has RDRAND, riscv64 has Zkr,
but QEMU's aarch64 CPU models have neither -- confirmed against QEMU
10.2.1. A deterministic PRNG (fine for VM UUIDs) is not safe for key
generation, so this adds a virtio-rng device instead of a per-arch split:
real host entropy, identical guest-side protocol on all three arches.

New src/starkernel/virtio/virtio_rng.c + include/starkernel/virtio_rng.h,
transport plumbing mirroring the existing virtio_blk.c driver exactly.
Wired into kernel_main.c boot, -device virtio-rng-pci added to all three
QEMU targets.

Verified live (temp probe, written/run/captured/reverted): 16 real bytes
pulled through the full request/notify/poll round trip on all three
arches, three different values confirming real entropy. Final boot
against the reverted, permanent code: clean compile, clean boot to ok>
on amd64/aarch64/riscv64, Stadium conservation intact, no panics or
guest errors.

Ed25519 keygen/signing itself (Phase B) and the MINT word design
(Phase C) remain open, documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

include/starkernel/virtio_rng.h

@@ -0,0 +1,58 @@
+/*
+ * virtio_rng.h — Virtio 1.0 entropy source driver for StarKernel
+ *
+ * Real hardware/host entropy, uniformly across all three architectures.
+ * Exists specifically because this kernel has no per-arch RNG that covers
+ * all three ISAs: amd64 has RDRAND and riscv64 has the Zkr extension, but
+ * QEMU's aarch64 CPU models (including "max") expose neither RNDR nor any
+ * other RNG property (checked directly against QEMU 10.2.1, see
+ * vm_uuid.h's identical finding). A paravirtualized virtio-rng device
+ * sidesteps the per-ISA gap entirely: the host supplies the entropy, the
+ * guest-side protocol is identical on all three arches.
+ *
+ * QEMU-only: there is no virtio-rng on real hardware (Milestone 8, bare-
+ * metal boot). A real per-arch RNG driver is a separate, later problem.
+ *
+ * Only one virtio-rng device is supported.
+ */
+
+#ifndef STARKERNEL_VIRTIO_RNG_H
+#define STARKERNEL_VIRTIO_RNG_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+/* virtio PCI vendor (shared with every virtio device) */
+#define VIRTIO_RNG_PCI_VENDOR_ID 0x1AF4u
+/* device IDs: virtio device id 4 (entropy source) */
+#define VIRTIO_RNG_DEVICE_MODERN 0x1044u
+#define VIRTIO_RNG_DEVICE_LEGACY 0x1005u
+
+/*
+ * virtio_rng_init — locate the virtio-rng device on the PCI bus and bring
+ * the driver up. Call once, before the first virtio_rng_get_bytes() call.
+ *
+ * Returns  0 on success.
+ * Returns -1 if no virtio-rng device was found on the PCI bus.
+ * Returns -2 on driver initialisation failure (bad BAR, queue setup, etc.).
+ */
+int virtio_rng_init(void);
+
+/*
+ * virtio_rng_ready — 1 if virtio_rng_init() has already succeeded.
+ */
+int virtio_rng_ready(void);
+
+/*
+ * virtio_rng_get_bytes — fill buf with n bytes of real host-supplied
+ * entropy, blocking (polling) until all n bytes are obtained. The device
+ * may return fewer bytes than requested per request; this loops
+ * internally until the buffer is full.
+ *
+ * Returns  0 on success (buf fully filled).
+ * Returns -1 if virtio_rng_init() has not succeeded.
+ * Returns -2 on a device/timeout error partway through.
+ */
+int virtio_rng_get_bytes(uint8_t *buf, size_t n);
+
+#endif /* STARKERNEL_VIRTIO_RNG_H */