xHCI/BOT driver: genuine multi-device support (FABRIC-3.md §VII)

Per-slot registry (xhci_msc_slot_t/dev->msc_slots, sized off the
controller's own reported max_slots) replaces the single-device scalar
fields the driver carried since Milestones 2e-2h. Boot-time port scan no
longer stops at the first connected device; a connect/disconnect that
arrives while the Command Ring is busy is now queued and drained instead
of dropped. blkio_usb.c and repl.c's own single-device state (device
descriptor buffers, blkio_dev_t, attach bookkeeping) became per-slot
registries the same way.

Live multi-device testing (not just compiling) surfaced a second, more
severe bug outside the original plan: transfer_purpose and next_action
were also single scalars shared across the whole controller. Two devices
enumerating concurrently could have one's completion silently overwrite
the other's still-outstanding one, permanently stalling it with no error.
Fixed by moving both per-slot and, critically, reading the Transfer Event
TRB's own real Slot ID field instead of trusting external bookkeeping.

Verified live, all three architectures, mandatory clean-qemu acceptance:
existing single-device path unchanged, and two devices attached
simultaneously (amd64) both progress independently through enumeration
without corrupting or stalling each other.

Also in this pass (implemented and verified in earlier turns this
session, committed together per direct instruction):
- Headless-until-login console policy: no prompt/banner until a real
  identity logs in via an attached thumbdrive (WIREBIND or Zuse, neither
  special), reusing EMERGENCY_CONSOLE_ENABLED as the debug/recovery
  escape hatch (now default-off).
- KILL/g_repl_active_vm dangling-pointer fix: killing the VM the console
  is currently USE'd onto now detaches back to Hera first, matching the
  existing EJECT/UNCLEAN precedent.

FABRIC-3.md §VII/§VIII carry full closure notes for all three.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018EjXFo7mPXjUMjfJeuUUz4

include/starkernel/repl.h

@@ -135,6 +135,48 @@ int sk_console_key_available(void);
  */
 int sk_console_readline(char* buf, int size, VM* active_vm, int reanchor_prompt);
 
+/**
+ * sk_console_mark_login - Record that a real identity has logged in via an
+ * attached thumbdrive, decided in conversation 2026-09-05: no console for
+ * the running system unless a thumbdrive is present -- headless until the
+ * first successful login, regardless of which path performs it (a regular
+ * user's WIREBIND console-VM birth, capsule_wirebind.c, or Zuse's own
+ * attach/genesis-mint, capsule_zuse_boot.c). Both call this on their own
+ * success path; neither is treated as special here, per direct instruction
+ * ("nothing special about zuse as a user except zuse has no ACLs") --
+ * this is one shared signal, not a Zuse-specific carve-out. Idempotent
+ * (a second login, e.g. a second WIREBIND user later, is a harmless no-op).
+ */
+void sk_console_mark_login(void);
+
+/**
+ * sk_console_login_occurred - Whether sk_console_mark_login() has ever
+ * been called this boot. Read by sk_repl_headless_wait()'s own exit
+ * condition; exposed publicly for anything else that needs to know
+ * whether the console is unlocked yet.
+ */
+int sk_console_login_occurred(void);
+
+/**
+ * sk_repl_headless_wait - Idle-service loop with no interactive surface
+ * at all: no banner, no prompt, no console_getc()/readline. Runs
+ * heartbeat_service() and the same SK_IDLE_BEAT_INTERVAL-gated
+ * sk_repl_idle(mama) cadence sk_console_readline()'s own idle branch
+ * uses -- so USB/WIREBIND/Zuse-attach detection, the heartbeat, and all
+ * other idle-tick subsystems keep running -- until sk_console_login_
+ * occurred() becomes true, at which point it returns. Called from
+ * kernel_main.c in place of an immediate sk_repl(mama) call when
+ * EMERGENCY_CONSOLE_ENABLED is off (the new default, 2026-09-05): no
+ * thumbdrive, no prompt, per direct instruction. When
+ * EMERGENCY_CONSOLE_ENABLED is on (the debug/recovery escape hatch),
+ * kernel_main.c skips this and calls sk_repl(mama) immediately instead,
+ * exactly as before this change.
+ *
+ * @param mama  Hera's own VM instance -- the idle-dispatch target,
+ *              same as every other sk_repl_idle() caller uses.
+ */
+void sk_repl_headless_wait(VM *mama);
+
 #ifdef __cplusplus
 }
 #endif