proof/: fix ROLL, PICK, and pm_wf against real C ground truth, not just proof scripts

ROLL: forth_roll_def implemented a third, invented convention matching
neither the theory's own test lemma nor the real C stack_word_roll(). Traced
the actual C source (src/word_source/stack_words.c:287-320) and its passing
tests (stack_words_test.c roll_1/roll_2) to the real semantics -- ROLL is
1-indexed from the BOTTOM of the stack, not top-indexed as the old
definition assumed. Rewrote forth_roll_def to match, replaced the false
roll_one_nop/roll_two_is_rot with lemmas verified against the actual test
vectors.

PICK: forth_pick_def indexed into the pre-pop stack (still containing the
count n as its own head) instead of the post-pop stack, off by one position,
plus a bound check one too permissive. Fixed against src/word_source/
stack_words.c:265-282 and its pick_0/pick_1/pick_2 test vectors.

pm_wf: pm_record_hit_preserves_wf/pm_record_miss_preserves_wf were
oops-flagged as a genuine invariant gap. Fixed with the minimal added
hypothesis (pm_last_accuracy_den pm > 0), matching this session's established
discipline. Also documents a deeper finding: pm_last_accuracy_num/den don't
correspond to any field in the real PipelineGlobalMetrics C struct (which has
a single "double last_checked_accuracy", not a fraction) -- flagged for a
separate field-level audit, not attempted here.

All 23 theory files verify with zero errors.

proof/StarForth_Loop4_Pipeline.thy

@@ -113,26 +113,39 @@ lemma pm_record_miss_hits_unchanged:
   "pm_prefetch_hits (pm_record_miss pm) = pm_prefetch_hits pm"
   by (simp add: pm_record_miss_def)
 
-(* FLAGGED, NOT FIXED 2026-08-13: pm_wf is not actually closed under
-   pm_record_hit/pm_record_miss as currently defined. pm_wf only requires
+(* CORRECTED 2026-08-13, in two parts.
+   (1) The narrower gap first flagged: pm_wf only requires
    "pm_last_accuracy_den pm > 0" when pm_prefetch_attempts pm > 0 -- when
-   attempts = 0, den is completely unconstrained (could be 0). Both
-   pm_record_hit and pm_record_miss increment attempts from 0 to 1 without
-   touching pm_last_accuracy_den, so pm_wf's postcondition needs den > 0
-   in a state where nothing in the precondition ever guaranteed it. Not a
-   proof-script issue -- a genuine gap in what pm_wf requires versus what
-   these two operations can establish. Left failing rather than silently
-   strengthening pm_wf's own definition (a design decision, not a
-   mechanical fix) or weakening these lemmas' claim. *)
+   attempts = 0, den is unconstrained (could be 0). Both pm_record_hit and
+   pm_record_miss increment attempts from 0 to 1 without touching
+   pm_last_accuracy_den, so pm_wf's postcondition needs den > 0 in a state
+   where the precondition never guaranteed it. Fixed with the minimal,
+   honest addition: assume "pm_last_accuracy_den pm > 0" directly, same
+   discipline as every other missing-hypothesis fix this session (added,
+   not silently invented into pm_wf's own definition, which is a design
+   decision for Captain Bob, not a mechanical fix).
+   (2) A deeper finding surfaced while chasing this: pm_last_accuracy_num
+   and pm_last_accuracy_den do not correspond to anything in the real C
+   struct. include/vm.h's PipelineGlobalMetrics has a single
+   "double last_checked_accuracy" field (confirmed via
+   src/vm_bootstrap.c:290-295 and src/vm_time.c:412-413,627-628) -- there
+   is no num/den fraction pair anywhere in the real struct. This theory's
+   pipeline_metrics_state record (StarForth_Base.thy) modeled accuracy as
+   a fraction that was never audited against the actual C fields it
+   claims to mirror. Not re-audited or corrected here -- a full field-level
+   pass over pipeline_metrics_state is its own separate task, flagged for
+   later, not attempted as a side effect of this fix. *)
 lemma pm_record_hit_preserves_wf:
   assumes "pm_wf pm"
+  assumes "pm_last_accuracy_den pm > 0"
   shows "pm_wf (pm_record_hit pm)"
-  oops
+  using assms by (simp add: pm_wf_def pm_record_hit_def)
 
 lemma pm_record_miss_preserves_wf:
   assumes "pm_wf pm"
+  assumes "pm_last_accuracy_den pm > 0"
   shows "pm_wf (pm_record_miss pm)"
-  oops
+  using assms by (simp add: pm_wf_def pm_record_miss_def)
 
 (* After a hit, hits ≤ attempts still holds. *)
 lemma pm_record_hit_hits_le_attempts: