Phase 8: zuse cert storage moved out of the dictionary (fuse-blow install)

Found that a pinned CONSTANT is not actually tamper-proof: ACL-PIN only
blocks redefinition, not a >BODY-then-store on the word's existing data
field. Moves the Zuse cert value into C-only VM struct fields
(zuse_cert_lo/hi + zuse_cert_installed fuse bit) with a one-time
vm_zuse_cert_install() and read-only ZUSE-CERT-LO@/HI@/INSTALLED? FORTH
accessors, closing the tamper path structurally instead of by convention.
Deletes the now-insecure ZUSE-CERT-LO/HI CONSTANT words from zuse.4th.

vm_zuse_cert_install() has no caller yet -- the real mint flow (Milestone
6 CA, the MINT word) is still open; this is storage + accessors only, not
a stand-in mint. Documented in FABRIC-3.md. Verified: hosted build clean,
mkcapsule --lint clean (31/31), clean boot to ok> on amd64/aarch64/riscv64
with Stadium conservation intact and no panics.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

include/vm.h

@@ -392,6 +392,11 @@ typedef struct VM
     uint8_t emergency_console; /**< 1 = fault handler active; bypasses all ACL checks (C-only write) */
     uint8_t zuse_session;      /**< 1 = zuse authenticated at console; shows zuse)ok> prompt */
     uint8_t acl_skip;          /**< 1 = skip all ACL hooks (Ananke enforcement VM; prevents recursion) */
+    uint8_t zuse_cert_installed; /**< 1 = zuse_cert_lo/hi hold a real minted cert (one-time fuse) */
+    uint64_t zuse_cert_lo;     /**< Zuse cert value, low half. C-only write via vm_zuse_cert_install(). */
+    uint64_t zuse_cert_hi;     /**< Zuse cert value, high half. No FORTH word can write these fields --
+                                 *   deliberately kept out of the dictionary so ACL-PIN's redefinition-only
+                                 *   guarantee can't be bypassed via >BODY on a CONSTANT (see FABRIC-3.md). */
     /** @} */
 
     /** @name Dictionary Management 
@@ -626,6 +631,11 @@ cell_t* vm_dictionary_get_data_field(DictEntry* entry);
 
 void vm_compile_word(VM* vm, DictEntry* entry);
 
+/* Zuse cert one-time install (blows the fuse). Returns 0 on success, -1 if
+ * already installed -- a second call is a caller bug, not a runtime error to
+ * recover from silently. C-only: no FORTH word wraps this. */
+int vm_zuse_cert_install(VM* vm, uint64_t lo, uint64_t hi);
+
 /* Memory management */
 void* vm_allot(VM* vm, size_t bytes);