WIREBIND: real thumbdrive-attach call site, no manual steps

Assembles pieces already built and individually verified this session
-- CERTVERIFY (vm_identity_from_cert(), Phase A/B), RUNCAP, the
console-VM + user-VM pair (§F.22) -- into one automatic sequence,
replacing the RUNCAP-TEST/PAIR-TEST diagnostic words that exercised
each piece by hand.

New capsule_wirebind_try_attach() (capsule_wirebind.h/.c), called from
sk_repl_idle() alongside capsule_zuse_boot_try_attach() on every
HOMEBLOCKS_SIG_OK attach: sig->cert_offset==0 means this is Zuse's own
genesis-mode drive (no cert region) -- that's already
capsule_zuse_boot_try_attach()'s job, skip. Otherwise, with Zuse already
authenticated this boot (nothing to verify a regular cert against
otherwise), reads the cert devblock(s) and calls vm_identity_from_cert()
against mama_vm's own zuse_cert_pubkey and the drive's own drive_uuid.
On success: reads the drive's own user_identity_seed_t for its
username, births a console VM + RUNCAP-born user VM pair (idempotent --
no-ops if that username is already live this session), installs the
verified VMIdentity onto the user VM, and registers the "<username>~user"
pairing sk_repl_dispatch_line() (repl.c, §F.22) looks for. Deliberately
does NOT auto-USE the new console -- that stays an explicit,
ACL-gated step (BINDSTEP, §F.9), not something a bare attach should
trigger silently.

Verified end-to-end live in QEMU, including a genuine negative case:
attached disk/user1.img (signed by a different, earlier-session Zuse
instance) and got a correct "cert verification FAILED -- drive
refused" -- proof the check is real, not a rubber stamp. Minted a
fresh identity with this boot's own Zuse, reattached, and got
"WIREBIND: SamS attached and ready" printed with zero manual commands,
followed by a working USE + async WELCOME relay end to end (queued,
no UNKNOWN WORD, delivered and executed in the paired user VM on the
next idle tick). Clean 3-architecture regression: Hermes/Artemis both
birth live, no unexpected ACL denials or UNKNOWN WORD.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/starkernel/capsule_wirebind.h

@@ -0,0 +1,60 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  Licensed under the StarForth License, Version 1.0
+*/
+
+/**
+ * capsule_wirebind.h - WIREBIND: the real thumbdrive-attach call site
+ * (FABRIC-3.md §F.5/§F.23). Assembles pieces already built and
+ * individually verified this session -- CERTVERIFY (vm_identity.h's
+ * vm_identity_from_cert()), RUNCAP (capsule_runcap.h), the console-VM +
+ * user-VM pair (capsule_console.h, sk_repl_dispatch_line() in repl.c) --
+ * into one automatic sequence, replacing the RUNCAP-TEST/PAIR-TEST
+ * diagnostic words that exercised each piece by hand.
+ */
+
+#ifndef STARKERNEL_CAPSULE_WIREBIND_H
+#define STARKERNEL_CAPSULE_WIREBIND_H
+
+#ifdef __STARKERNEL__
+
+#include "starkernel/homeblocks_sig.h"
+#include "vm.h"
+
+struct blkio_dev;
+
+/**
+ * capsule_wirebind_try_attach - Try to verify and bind a just-attached
+ * regular (non-Zuse) identity drive.
+ *
+ * No-op if sig->cert_offset is 0 (a genesis-mode Zuse drive has no cert
+ * region -- that's capsule_zuse_boot_try_attach()'s own job, not this
+ * one's) or if mama_vm has no installed Zuse cert yet (nothing to verify
+ * the attached cert against). Otherwise: reads the cert devblock(s),
+ * calls vm_identity_from_cert() against mama_vm's own zuse_cert_pubkey
+ * and sig->drive_uuid. On success, reads the drive's own
+ * user_identity_seed_t for its username and births a console VM +
+ * RUNCAP-born user VM pair (idempotent -- no-ops if that username is
+ * already live this session), installs the verified VMIdentity onto the
+ * user VM, and registers the "<username>~user" pairing
+ * (sk_repl_dispatch_line(), repl.c, looks for this). Does NOT USE the
+ * new console automatically -- that stays an explicit, later,
+ * ACL-gated step (BINDSTEP, §F.9), not something a bare attach should
+ * trigger silently.
+ *
+ * @param dev     The just-attached, already-open block device.
+ * @param sig     Its already-checked homeblocks_sig_t.
+ * @param mama_vm Hera's own VM (the verifier -- her zuse_cert_pubkey is
+ *                the trust root regular user certs are checked against).
+ */
+void capsule_wirebind_try_attach(struct blkio_dev *dev,
+                                  const homeblocks_sig_t *sig,
+                                  VM *mama_vm);
+
+#endif /* __STARKERNEL__ */
+
+#endif /* STARKERNEL_CAPSULE_WIREBIND_H */