§H.12 step 3: session_set_pinned/session_is_pinned pin-authority choke point

session_is_pinned() reads Session.pinned directly (authoritative, no
Stadium re-derivation); session_set_pinned() writes both Session.pinned
and the mirrored STADIUM_FLAG_PIN bit on the session's own patron cell,
keeping Stadium's internal eviction/admission logic (which must stay
self-contained) in sync without it calling back into session.c.

Added Session.stadium_cell (index into stadium_cells()) -- necessary
plumbing not in the original H.2 field list; the choke point can't reach
the right patron header without it. Moved STADIUM_FLAG_PIN from a
stadium.c-private #define to stadium.h (public) so session.c can
reference it without a duplicate definition.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

include/starkernel/vm/stadium.h

@@ -46,6 +46,16 @@
  * conflating "contains Hera" with "contains nothing." */
 #define STADIUM_CONTAINS_NONE ((uint32_t)-1)
 
+/* `flags` bit 0 -- pinned, exempt from eviction/reap. Moved here from a
+ * stadium.c-private #define (FABRIC-3.md §H.12 step 3) so session.c's pin-
+ * authority choke point (session_set_pinned()/session_is_pinned()) can
+ * write/read this same bit without a duplicate definition. Session is
+ * authoritative for every EXTERNAL reader (FABRIC-3.md §H.10) -- this bit
+ * on the raw patron header stays a mirrored copy purely for the Stadium
+ * engine's own internal eviction/admission logic (stadium.c), which must
+ * stay self-contained and not call back into session.c. */
+#define STADIUM_FLAG_PIN 0x01u
+
 /*
  * StadiumPatronHeader - one member of the closed two-valued cell union
  * (FABRIC.md §3). Nine wires: identity, heat, TTL, pin (a bit in `flags`),