starkernel: item 3.8 -- VM identifiers as UUID/GUID

Punch list §25 item 3.8 complete. Added after starting item 4.1
surfaced the need to thread a vm_id into stadium_admit()'s new quota
parameter; Captain Bob ruled UUID/GUID rather than keeping the
narrower uint32_t.

New VMUuid type (vm_uuid.h/vm_uuid.c): two uint64_t halves, RFC-4122-
shaped for logging. Not real randomness -- checked directly against
QEMU 10.2.1's actual CPU feature set: amd64 RDRAND and riscv64 Zkr are
both real, available features here; aarch64 has no RNG property on any
CPU model including "max" (verified exhaustively via QMP
query-cpu-model-expansion). Captain Bob ruled a uniform fallback
across all three ISAs rather than a per-architecture split.

Fallback is a deterministic PRNG (splitmix64) seeded from the Mama
capsule's content hash, pre-filling a 16-entry FIFO pool at boot and
refilling with another batch of the same stream when exhausted --
exactly the shape requested. Same capsule booted twice produces the
same id sequence, preserving the dict_hash reproducibility this
session has relied on throughout.

Hera keeps a fixed, reserved all-zero id, not drawn from the pool --
capsule_birth.c uses vm_id == 0 as a load-bearing sentinel in three
places (KILL protection x2, fleet heat-fanout parent-chain
terminator), found by reading before writing any code.

Two real sentinel-collision bugs caught before shipping, same class as
STADIUM_CONTAINS_NONE: vm_uuid_none() (all-ones, not all-zero) for
"not yet assigned"/"no VM" placeholders; confirmed item 3.7's quota
table already used an in_use boolean rather than a vm_id sentinel, so
no second collision was actually possible there -- the dead,
never-referenced STADIUM_QUOTA_SLOT_EMPTY macro was removed.

Blast radius larger than first scoped, flagged mid-work rather than
silently absorbed: capsule_vm_physics.c/.h (the fleet heat-transfer
layer item 2.1 modified earlier this session) has its own vm_id-keyed
node table and walks parent_vm_id chains through the same identity
space, so it needed the same change, plus its callers in
mama_forth_words.c and sk_vm_bootstrap.c.

One live FORTH word contract changed, by explicit ruling: CAPSULE-BIRTH
was ( capsule-id -- vm-id ), a single cell -- can't hold 128 bits.
Captain Bob picked pushing two cells ("there is doubles support in the
FORTH std word set anyway"): ( capsule-id -- vm-id-hi vm-id-lo ).
MAMA-VM-ID changed the same way: ( -- 0 0 ).

Verified: full (not standalone-file) kernel rebuild to catch cross-file
breakage given the size of this change -- it surfaced the
capsule_vm_physics.c blast radius a narrower check would have missed.
Three-architecture boot (amd64, aarch64, riscv64), all reaching ok>
with identical dict_hash=0x3d4e1daf289da94f matching the item-3.7
baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/starkernel/capsule_run.h

@@ -31,6 +31,7 @@
 #define STARKERNEL_CAPSULE_RUN_H
 
 #include <stdint.h>
+#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
 
 #ifdef __cplusplus
 extern "C" {
@@ -63,7 +64,7 @@ typedef enum {
 
 typedef struct {
     uint64_t run_id;         /* Sequential run identifier */
-    uint32_t vm_id;          /* Which VM executed this */
+    VMUuid   vm_id;          /* Which VM executed this (item 3.8) */
     uint32_t reserved;       /* Padding */
     uint64_t capsule_id;     /* Which capsule was run */
     uint64_t capsule_hash;   /* Hash at time of execution */
@@ -91,17 +92,18 @@ typedef enum {
 } VMState;
 
 typedef struct {
-    uint32_t vm_id;              /* Assigned at birth, immutable */
+    VMUuid   vm_id;              /* Assigned at birth, immutable (item 3.8) */
     uint32_t state;              /* VMState */
     uint64_t birth_capsule_id;   /* Which capsule birthed this VM */
     uint64_t birth_timestamp_ns; /* When VM was born */
     uint64_t birth_dict_hash;    /* Dictionary hash after birth */
     uint32_t flags;              /* VM flags */
-    uint32_t parent_vm_id;       /* Who birthed this VM. Set once at birth,
+    VMUuid   parent_vm_id;       /* Who birthed this VM. Set once at birth,
                                   * never rewritten. Hera's own entry is
                                   * self-referential (parent_vm_id == vm_id
-                                  * == 0) -- the sentinel a heat-fanout walk
-                                  * up the parent chain stops at. */
+                                  * == vm_uuid_hera(), all-zero) -- the
+                                  * sentinel a heat-fanout walk up the
+                                  * parent chain stops at. */
     void    *vm_ptr;             /* Pointer to live VM object; NULL when dead */
     char     name[VM_NAME_MAX];  /* Symbolic name, e.g. "Hera", "Hermes" */
 } VMRegistryEntry;
@@ -148,7 +150,7 @@ uint32_t capsule_run_log_count(void);
  *   PARITY:BIRTH vm_id=N capsule_id=X mode=p capsule_hash=H dict_hash=D
  */
 void capsule_parity_log_birth(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     uint64_t capsule_hash,
     uint64_t dict_hash
@@ -161,7 +163,7 @@ void capsule_parity_log_birth(
  *   PARITY:BIRTH_FAILED vm_id=N capsule_id=X error=E partial_dict_hash=H
  */
 void capsule_parity_log_birth_failed(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     CapsuleRunResult error,
     uint64_t partial_dict_hash
@@ -174,7 +176,7 @@ void capsule_parity_log_birth_failed(
  *   PARITY:RUN vm_id=N run_id=R capsule_id=X mode=e pre_dict=P post_dict=Q
  */
 void capsule_parity_log_run(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t run_id,
     uint64_t capsule_id,
     uint64_t pre_dict_hash,
@@ -200,7 +202,7 @@ void capsule_parity_log_mama_init(
  *   PARITY:KILL vm_id=N name=X
  */
 void capsule_parity_log_kill(
-    uint32_t vm_id,
+    VMUuid vm_id,
     const char *name
 );