starkernel: item 3.8 -- VM identifiers as UUID/GUID

Punch list §25 item 3.8 complete. Added after starting item 4.1
surfaced the need to thread a vm_id into stadium_admit()'s new quota
parameter; Captain Bob ruled UUID/GUID rather than keeping the
narrower uint32_t.

New VMUuid type (vm_uuid.h/vm_uuid.c): two uint64_t halves, RFC-4122-
shaped for logging. Not real randomness -- checked directly against
QEMU 10.2.1's actual CPU feature set: amd64 RDRAND and riscv64 Zkr are
both real, available features here; aarch64 has no RNG property on any
CPU model including "max" (verified exhaustively via QMP
query-cpu-model-expansion). Captain Bob ruled a uniform fallback
across all three ISAs rather than a per-architecture split.

Fallback is a deterministic PRNG (splitmix64) seeded from the Mama
capsule's content hash, pre-filling a 16-entry FIFO pool at boot and
refilling with another batch of the same stream when exhausted --
exactly the shape requested. Same capsule booted twice produces the
same id sequence, preserving the dict_hash reproducibility this
session has relied on throughout.

Hera keeps a fixed, reserved all-zero id, not drawn from the pool --
capsule_birth.c uses vm_id == 0 as a load-bearing sentinel in three
places (KILL protection x2, fleet heat-fanout parent-chain
terminator), found by reading before writing any code.

Two real sentinel-collision bugs caught before shipping, same class as
STADIUM_CONTAINS_NONE: vm_uuid_none() (all-ones, not all-zero) for
"not yet assigned"/"no VM" placeholders; confirmed item 3.7's quota
table already used an in_use boolean rather than a vm_id sentinel, so
no second collision was actually possible there -- the dead,
never-referenced STADIUM_QUOTA_SLOT_EMPTY macro was removed.

Blast radius larger than first scoped, flagged mid-work rather than
silently absorbed: capsule_vm_physics.c/.h (the fleet heat-transfer
layer item 2.1 modified earlier this session) has its own vm_id-keyed
node table and walks parent_vm_id chains through the same identity
space, so it needed the same change, plus its callers in
mama_forth_words.c and sk_vm_bootstrap.c.

One live FORTH word contract changed, by explicit ruling: CAPSULE-BIRTH
was ( capsule-id -- vm-id ), a single cell -- can't hold 128 bits.
Captain Bob picked pushing two cells ("there is doubles support in the
FORTH std word set anyway"): ( capsule-id -- vm-id-hi vm-id-lo ).
MAMA-VM-ID changed the same way: ( -- 0 0 ).

Verified: full (not standalone-file) kernel rebuild to catch cross-file
breakage given the size of this change -- it surfaced the
capsule_vm_physics.c blast radius a narrower check would have missed.
Three-architecture boot (amd64, aarch64, riscv64), all reaching ok>
with identical dict_hash=0x3d4e1daf289da94f matching the item-3.7
baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/vm/stadium.c

@@ -68,7 +68,7 @@ static size_t link_to_size(uint32_t v) {
  * rather than direct indexing.
  */
 typedef struct {
-    uint32_t vm_id;
+    VMUuid   vm_id;
     int      in_use;
     size_t   free_head;
 } StadiumVMQuota;
@@ -76,10 +76,10 @@ typedef struct {
 static StadiumVMQuota stadium_quotas[STADIUM_MAX_VM_COUNT];
 
 /* Returns the quota slot index for vm_id, or -1 if none is granted. */
-static int quota_slot_for_vm(uint32_t vm_id) {
+static int quota_slot_for_vm(VMUuid vm_id) {
     int i;
     for (i = 0; i < STADIUM_MAX_VM_COUNT; i++) {
-        if (stadium_quotas[i].in_use && stadium_quotas[i].vm_id == vm_id) return i;
+        if (stadium_quotas[i].in_use && vm_uuid_equal(stadium_quotas[i].vm_id, vm_id)) return i;
     }
     return -1;
 }
@@ -149,12 +149,12 @@ int stadium_boot_init(void) {
     {
         int i;
         for (i = 0; i < STADIUM_MAX_VM_COUNT; i++) {
-            stadium_quotas[i].vm_id     = 0;
+            stadium_quotas[i].vm_id     = vm_uuid_none();
             stadium_quotas[i].in_use    = 0;
             stadium_quotas[i].free_head = STADIUM_CELL_NONE;
         }
     }
-    stadium_quotas[0].vm_id     = 0;
+    stadium_quotas[0].vm_id     = vm_uuid_hera();
     stadium_quotas[0].in_use    = 1;
     stadium_quotas[0].free_head = 0;
 
@@ -309,7 +309,7 @@ int stadium_evict(size_t cell_index) {
  * contains-gated residents are skipped, never eviction candidates) and
  * evicting it only if the candidate is strictly denser.
  */
-size_t stadium_admit(uint32_t vm_id, const StadiumPatronHeader *candidate) {
+size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate) {
     int      slot;
     size_t   i;
     size_t   idx;