§H.12 step 15: FORTH wrappers for BMAPFMT block-ACL fields

BLK-ACL-ALLOW@/!, BLK-ACL-TTL@/!, BLK-OWNER@ registered in block_words.c.
BLK-OWNER@ packs the 8-byte owner fingerprint into one cell (cell_t is
int64_t). No BLK-OWNER! -- ownership stays a controlled C-only operation.

Live-tested via QMP keystrokes on a running instance: 1 BLK-ACL-ALLOW@
executed cleanly against a real block. Verified 3-arch boot to ok>
(amd64/aarch64/riscv64) plus a hosted sanity build (shared source).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

FABRIC-3.md

@@ -4069,7 +4069,15 @@ work, not new invention.
   tracking; these add no new state). FORTH wrappers (step 15) call these, not
   `blk_get_meta()`/`blk_set_meta()` directly, mirroring the word-level ACL system's own
   C-primitive/FORTH-policy split. Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64).
-- [ ] **15.** Add FORTH wrappers (`BLK-ACL-ALLOW@`/`!`, `BLK-ACL-TTL@`/`!`, `BLK-OWNER@`).
+- [x] **15. DONE 2026-09-03, live-tested.** `BLK-ACL-ALLOW@`/`!`, `BLK-ACL-TTL@`/`!`,
+  `BLK-OWNER@` registered in `block_words.c` (shared/vendored source — verified with both a
+  hosted sanity build and the 3-arch kernel boot). `BLK-OWNER@` packs the 8-byte fingerprint
+  into one cell (`cell_t` is `int64_t`, 8 bytes — exact fit, raw bit reinterpretation). No
+  `BLK-OWNER!` — only the five words step 15 itself listed; setting ownership stays a
+  controlled, C-only operation (MINT/birth), not a general FORTH write. **Live-tested via QMP
+  keystrokes on the running riscv64 instance**: `1 BLK-ACL-ALLOW@` executed cleanly (`ok`, no
+  `UNKNOWN WORD` error) against a real block. Verified 3-arch boot to `ok>`
+  (amd64/aarch64/riscv64).
 - [ ] **16.** Add a new policy capsule (mirroring `ACL.4th`) with a real fast-deny check on
   top — no stub, per this project's standing "no stubs or TODOs, ever" rule (§C).