Fix riscv64 hosted acceptance-test doc; port 3 clang-surfaced bugs from punch list

Addresses items #1 (partial) and #2 of
docs/working/archive/session-logs/2026-07-24-punch-list.md.

docs/lithosananke/hosted-acceptance-test/README.md:
- riscv64 leg used riscv64-linux-gnu-gcc, which fails to build this tree
  (nanosleep visibility under -std=c99). Replaced with the working
  clang-18 --target=riscv64-linux-gnu --sysroot=/usr/riscv64-linux-gnu
  invocation, verified end-to-end.
- All three arch sections referenced a -c "<script>" flag that has never
  existed in cli.c/main.c. Corrected to the working
  `echo "..." | starforth -s` pattern, verified on all three architectures.
- Updated Prerequisites: qemu-user alone is sufficient (guest binaries are
  static; qemu-user-static provides static *emulators*, not required here).

Source fixes (ported from the old pre-split monorepo's master, commit
4db9946a, where they were made but never carried over to this line):
- src/math_portable.c: `-100LL << 16` is UB (shifting a negative value)
  under clang's -Wshift-negative-value; changed to `-(100LL << 16)`.
- src/physics_pipelining_metrics.c: removed dead q48_mul_q48()
  (-Wunused-function under clang; GCC doesn't flag this by default).
- src/word_source/editor_words.c: removed dead set_scr() (same reason).

These three were required just to get the documented clang build to
compile at all. The punch list's higher-severity item — a genuine
SIGSEGV-causing register-reuse hazard in vm_pop_asm/vm_rpop_asm
(include/vm_asm_opt_riscv64.h) — is intentionally NOT included here; it's
a separate, more careful change and isn't required for this build to
succeed (latent only under clang; this repo's kernel build uses GCC).

Verified: all three hosted builds compile and run correctly (amd64
native, aarch64 via qemu-aarch64, riscv64 via qemu-riscv64), each
printing "3 Goodbye!" for the piped `1 2 + . BYE` script. All three
Makefile.starkernel builds (amd64/aarch64/riscv64) still compile cleanly
with these shared vendored-source changes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/math_portable.c

@@ -94,7 +94,7 @@ static int64_t exp_q48(int64_t x) {
     /* Handle extremes */
     if (x == 0) return Q48;
     if (x > (20LL << 16)) return Q48 << 8;  /* Approximate e^20 */
-    if (x < (-100LL << 16)) return 0;       /* Underflow to zero */
+    if (x < -(100LL << 16)) return 0;       /* Underflow to zero */
 
     /* Taylor series: exp(x) = Σ x^n / n! (in fixed-point) */
     int64_t result = Q48;  /* Start with 1 */

src/physics_pipelining_metrics.c

@@ -116,28 +116,6 @@ static inline int64_t q48_div_u64(int64_t a_q48, uint64_t b) {
     return a_q48 / (int64_t)b;
 }
 
-/**
- * @brief Multiply two Q48.16 values, returning a Q48.16 result.
- *
- * Computes @p a × @p b and right-shifts by 16 to cancel the extra scaling
- * factor introduced by multiplying two Q48.16 numbers:
- * @code
- *   (a × b) >> 16  →  Q48.16
- * @endcode
- * This is the standard fixed-point multiply for the same format on both
- * operands. Overflow is possible if both operands are large (the intermediate
- * product can reach 2^(48+48+16) = 2^112 in the worst case, which overflows
- * @c int64_t). In practice the operands are probabilities (0.0–1.0) or
- * latency fractions that keep the product well within int64 range.
- *
- * @param a  First Q48.16 operand.
- * @param b  Second Q48.16 operand.
- * @return   @p a × @p b in Q48.16.
- */
-static inline int64_t q48_mul_q48(int64_t a, int64_t b) {
-    return (a * b) >> 16;
-}
-
 /* ============================================================================
  * Transition Metrics Implementation
  * ============================================================================

src/word_source/editor_words.c

@@ -59,14 +59,6 @@ static inline cell_t current_scr(VM *vm) {
     return vm_load_cell(vm, vm->scr_addr);
 }
 
-/** @brief Set current screen number in VM
- *  @param vm Pointer to VM instance
- *  @param blk Screen number to set
- */
-static inline void set_scr(VM *vm, cell_t blk) {
-    vm_store_cell(vm, vm->scr_addr, blk);
-}
-
 /** @brief Get pointer to specific line in a screen
  *  @param vm Pointer to VM instance
  *  @param scr Screen number (1-based)