Stadium: real VM-patron admission + real COOL dispatch at KILL (FABRIC-3.md §B)

capsule_vm_kill() had zero Stadium involvement (vm_cleanup()/sf_free()
only), and child-VM birth only ever called stadium_grant_quota() -- a
resource pool for the VM's own future word/block patrons, never
stadium_admit() for the VM itself. stadium_birth_hera() looked like a
precedent but admits Hera into her own quota as a permanently pinned
cell 0, which can never reach stadium_evict() -- not a working example
of COOL firing for a VM.

Adds size_t stadium_patron_cell to VMRegistryEntry. At birth, right
after the existing stadium_grant_quota() call, admits a candidate into
the new VM's own quota mirroring stadium_birth_hera()'s shape
(identity=0, mass=1, behaviour=COOL) but deliberately unpinned --
pinning would need a new "unpin" primitive (none exists) to ever evict
it later, and unpinned costs nothing since nothing wires COOL's
dispatch body to kill anything; the worst case of an unrelated natural
eviction is stale bookkeeping, tolerated the same way
stadium_word_forget() already tolerates staleness elsewhere. At
capsule_vm_kill() and capsule_vm_kill_all_nonmama(): stadium_evict()
the tracked cell if still resident, silently tolerating refusal
(already gone). stadium_dispatch()'s COOL case needed no new payload
body -- same as it already is for words, where COOL has no defined
extra action beyond stadium_evict()'s own universal reservoir credit.

On investigation this turned out not to be entangled with the
still-iterating Tripod/Zuse/messaging vision after all -- birth and
kill already funnel through two single choke points, so the earlier
deferral (previous commit) was overcautious.

Verified live: a second, new "Stadium: dispatch cell=... behaviour=
COOL" now fires immediately before every PARITY:KILL line, for both
Hermes and Artemis, distinct from the pre-existing COMMON-CH
word-eviction self-test's own COOL print. Conservation
(resident_sum + reservoir == Q48_ONE) intact throughout. Clean
zero-warning compile and clean boot on all three architectures.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

FABRIC-3.md

@@ -359,12 +359,34 @@ other three become honest, explicit punch-list items instead of being touched sp
   USE` now correctly prints `USE: now using Artemis` and switches the REPL's console-name
   coloring, confirming the C primitive runs unshadowed. Clean compile and clean boot with
   conservation intact on all three architectures (amd64/aarch64/riscv64).
-- [ ] Scope VM-`COOL`: confirm whether `capsule_vm_kill()`/Tripod's existing VM lifecycle has
-  any real hook point equivalent to `stadium_evict()`, or needs the same kind of admission
-  work `MIGRATE` needs. **Deferred (2026-08-25)** per the user's own "we're going to have to
-  iterate" framing of the final Tripod/Zuse/messaging shape (see §D below) — building VM
-  eviction/cooling machinery ahead of that design risks throwaway or conflicting work. Resolve
-  only after that shape is nailed down, or if it turns out trivially small on its own.
+- [x] **Resolved (2026-08-26): real VM-patron admission + real explicit-KILL eviction, both
+  live.** Re-scoped on request: confirmed `capsule_vm_kill()` had zero Stadium involvement
+  (`vm_cleanup()`/`sf_free()` only) and child-VM birth only ever called
+  `stadium_grant_quota()` (a resource pool for the VM's *own* future word/block patrons) —
+  never `stadium_admit()` for the VM *itself*. The only precedent, `stadium_birth_hera()`,
+  admits Hera into her own quota as a permanently pinned cell 0, which can never reach
+  `stadium_evict()` — not a working example of `COOL` firing for a VM. On closer look this
+  turned out NOT to be entangled with the still-iterating Tripod/Zuse/messaging vision after
+  all (§D) — birth and kill already funnel through two single choke points, so the earlier
+  2026-08-25 deferral was overcautious. **Design:** added `size_t stadium_patron_cell` to
+  `VMRegistryEntry` (`capsule_run.h`). At birth, right after the existing
+  `stadium_grant_quota()` call (`capsule_birth.c`), admit a candidate into the new VM's own
+  quota mirroring `stadium_birth_hera()`'s shape (`identity=0`, `mass=1`, `behaviour=COOL`)
+  but deliberately **unpinned** — pinning would need a new "unpin" primitive (none exists) to
+  ever evict it later, and adding a pin-bypass to `stadium_evict()`'s refusal logic isn't
+  something to do casually; unpinned costs nothing since nothing wires `COOL`'s dispatch body
+  to actually kill anything, so the worst case of an unrelated natural eviction is
+  `stadium_patron_cell` going stale, which is tolerated the same way `stadium_word_forget()`
+  already tolerates staleness. At `capsule_vm_kill()` and `capsule_vm_kill_all_nonmama()`:
+  `stadium_evict()` the tracked cell if still resident, silently tolerating refusal (already
+  gone). `stadium_dispatch()`'s `COOL` case needed no new payload body — same as it already is
+  for words, where `COOL` has no defined extra action beyond `stadium_evict()`'s own universal
+  reservoir credit; the missing piece was admission and a genuine trigger, not dispatch-body
+  logic. **Verified live:** a second, new `Stadium: dispatch cell=... behaviour=COOL` now
+  fires immediately before every `PARITY:KILL` line, for both Hermes and Artemis, confirmed on
+  amd64 (distinct from the pre-existing `COMMON-CH` word-eviction self-test's own COOL print).
+  Conservation (`resident_sum + reservoir == Q48_ONE`) intact throughout. Clean zero-warning
+  compile and clean boot on all three architectures (amd64/aarch64/riscv64).
 - [ ] `DELIVER` (Hermes) — scope as its own future item once `MIGRATE`/VM-`COOL` land; do not
   re-decide the `DELIVER`-vs-`EXPIRE` message/channel mapping here, `FABRIC.md`'s own note
   already flags it as genuinely open, not casually assumable.