FABRIC-3.md §I.3/§I.8: WIREBIND EJECT/detach + EXPIRE re-scoped as logout

Closes §I.3 (Milestone 5 remainder): WIREBIND now tracks which VM is
attached via the home-blocks USB path, and a new EJECT word plus the
existing hot-unplug signal both flush/reset-console/kill through it
(FABRIC-3.md §F.10).

Closes §I.8 (EXPIRE/ACL), re-scoped: the original "admit the zuse
session as a Stadium patron and reap on TTL" plan was invalidated a
second time -- Zuse authenticates directly onto Hera, who is patron
zero and permanently pinned, so there is no patron for a reap sweep to
ever find. Built instead as a detach-triggered logout
(capsule_zuse_boot_logout()), the same trigger EJECT/hot-unplug use for
regular WIREBIND users, so neither identity is a special case. Required
a companion fix: install_and_activate() used to skip re-running
ACL-ZUSE-BOOT whenever the cert was already installed, which made a
logout permanent for the rest of the boot; the outer re-attach gate now
checks zuse_session (clears on logout) instead of zuse_cert_installed
(a deliberate permanent one-way ratchet, left untouched).

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after both steps; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

include/starkernel/capsule_zuse_boot.h

@@ -58,6 +58,28 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
                                    const homeblocks_sig_t *sig,
                                    VM *mama_vm);
 
+/**
+ * capsule_zuse_boot_logout - End Zuse's session when her own attached
+ * drive detaches (FABRIC-3.md §I.8, re-scoped 2026-09-04: no identity is
+ * different here -- Zuse logs out on device removal exactly like a
+ * WIREBIND user does, not via a Stadium-patron TTL. She has no separate
+ * VM or blocks of her own, so unlike capsule_wirebind_eject()/
+ * _unclean_detach() there is no flush step to skip on the abrupt path --
+ * one function covers both the graceful (EJECT) and abrupt (hot-unplug)
+ * call sites identically.
+ *
+ * No-op if the currently-tracked attached device isn't Zuse's own
+ * (nothing to do -- some other identity's drive is what's leaving, or
+ * nothing is attached at all). Clears mama_vm->zuse_session only --
+ * zuse_cert_installed and the cert itself stay put, permanently, per
+ * vm_zuse_cert_install()'s own one-way design; re-attaching her own
+ * drive re-authenticates via capsule_zuse_boot_try_attach() without
+ * re-minting anything.
+ *
+ * @param mama_vm Hera's own VM (zuse_session lives here).
+ */
+void capsule_zuse_boot_logout(VM *mama_vm);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_CAPSULE_ZUSE_BOOT_H */