xHCI/BOT driver: genuine multi-device support (FABRIC-3.md §VII)

Per-slot registry (xhci_msc_slot_t/dev->msc_slots, sized off the
controller's own reported max_slots) replaces the single-device scalar
fields the driver carried since Milestones 2e-2h. Boot-time port scan no
longer stops at the first connected device; a connect/disconnect that
arrives while the Command Ring is busy is now queued and drained instead
of dropped. blkio_usb.c and repl.c's own single-device state (device
descriptor buffers, blkio_dev_t, attach bookkeeping) became per-slot
registries the same way.

Live multi-device testing (not just compiling) surfaced a second, more
severe bug outside the original plan: transfer_purpose and next_action
were also single scalars shared across the whole controller. Two devices
enumerating concurrently could have one's completion silently overwrite
the other's still-outstanding one, permanently stalling it with no error.
Fixed by moving both per-slot and, critically, reading the Transfer Event
TRB's own real Slot ID field instead of trusting external bookkeeping.

Verified live, all three architectures, mandatory clean-qemu acceptance:
existing single-device path unchanged, and two devices attached
simultaneously (amd64) both progress independently through enumeration
without corrupting or stalling each other.

Also in this pass (implemented and verified in earlier turns this
session, committed together per direct instruction):
- Headless-until-login console policy: no prompt/banner until a real
  identity logs in via an attached thumbdrive (WIREBIND or Zuse, neither
  special), reusing EMERGENCY_CONSOLE_ENABLED as the debug/recovery
  escape hatch (now default-off).
- KILL/g_repl_active_vm dangling-pointer fix: killing the VM the console
  is currently USE'd onto now detaches back to Hera first, matching the
  existing EJECT/UNCLEAN precedent.

FABRIC-3.md §VII/§VIII carry full closure notes for all three.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018EjXFo7mPXjUMjfJeuUUz4

include/starkernel/blkio_usb.h

@@ -13,8 +13,14 @@
  * BAM/reloc zero-page writes and an explicit block content write both
  * survived a cold reboot and read back correctly.
  *
- * Only one USB MSC device is supported (single-outstanding-transaction
- * scope, matching the xHCI driver it sits on).
+ * FABRIC-3.md §VII (2026-09-05): multiple simultaneously-attached USB MSC
+ * devices are now supported -- each open() call is backed by its own
+ * per-slot state (blkio_usb.c's own registry, keyed by xHCI slot ID,
+ * mirroring xhci_dev_t's msc_slots[]). The underlying xHCI/BOT command
+ * machinery still runs one bulk transfer at a time across the whole
+ * controller (real xHCI semantics, not a limitation introduced here) --
+ * see xhci_msc_slot_t's own doc comment for the persistent-vs-in-flight
+ * distinction this rests on.
  */
 
 #ifndef STARKERNEL_BLKIO_USB_H