proof/: add StarForth_Q48_Words.thy (q48_words.c coverage)

17 of 23 words fully modelled (Q.+/-/*//,  Q.ABS/NEG, Q.FROM-INT/TO-INT,
Q.1/0/SCALE, Q.=/</>/0=, Q.MAX/MIN), reusing q48_add/q48_mul/q48_div/
q48_from_u64/q48_to_u64 already in StarForth_Q48_16.thy and cell_abs
(Q.ABS's raw sign-bit test is bit-for-bit cell_abs's `n <s 0`). Added
q48_sub there alongside, the one missing arithmetic primitive.
Q.LOG/EXP/SQRT/SIN/COS deferred (same transcendental-approximation class
already excluded from the sweep at q48_16_words.c). Q.PRINT deferred
(stdout only).

Finding: every word in this file pops/pushes via the VM_POP/VM_PUSH
macros, which resolve to completely unchecked vm_pop_fast/vm_push_fast
when STARFORTH_PERFORMANCE is defined -- a build-flag-gated stack-safety
hazard distinct from (and broader than) the individual missing-guard
instances found elsewhere in the sweep, since it silently disables every
guard in the entire file at once. Modelled assuming the safe path.

Suite now 52 theories, green.

proof/ROOT

@@ -36,6 +36,7 @@ session "StarForth" = "HOL-Library" +
     StarForth_Lifecycle_Words_Hosted
     StarForth_Defer_Words
     StarForth_Log_Words
+    StarForth_Q48_Words
     StarForth_Loop1_Heat
     StarForth_Loop2_Window
     StarForth_Loop3_Decay