Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

FABRIC.md -> FABRIC-0.md
FABRIC-2.md -> FABRIC-1.md
FABRIC-3.md -> FABRIC-2.md (the current/living document)
FABRIC-4.md unchanged (new #3 to follow separately)

Every cross-reference repo-wide updated to match, including doc-comment
citations inside kernel source (.c/.h) files -- done via an ordered
placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md->
placeholder1, FABRIC.md->placeholder0, then placeholders resolved to
final names) in a single pass per file to avoid double-shifting
already-renamed references.

One line in capsules/font.4th grew past the 64-char block-format limit
as a side effect of the longer filename; shortened it and reverified
with mkcapsule --lint (34/34 pass) before rebuilding.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after the fix; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

include/starkernel/vm_identity.h

@@ -21,7 +21,7 @@
 */
 
 /**
- * vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-3.md
+ * vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-2.md
  * §F.2/§F.16, decided 2026-08-27/28)
  *
  * Holds only what a VM needs to prove *who owns it* and *what that owner
@@ -38,7 +38,7 @@
  * is not a structurally special VM: her identity just has every bit set.
  * No bit values are assigned yet -- deliberate slack, per this project's
  * "flexibility until we understand the recipe" precedent (see
- * blk_meta_t's own acl_reserved bytes, FABRIC-3.md §F.4) -- real bits get
+ * blk_meta_t's own acl_reserved bytes, FABRIC-2.md §F.4) -- real bits get
  * names only once the operation they gate actually gets built (BINDSTEP,
  * MINT, ...), not speculatively here.
  */
@@ -87,7 +87,7 @@ typedef struct {
 int vm_identity_has_cap(const VMIdentity *id, uint32_t cap);
 
 /**
- * vm_identity_from_cert - CERTVERIFY (FABRIC-3.md §F.7/§F.17): verify a
+ * vm_identity_from_cert - CERTVERIFY (FABRIC-2.md §F.7/§F.17): verify a
  * DER-encoded, Zuse-signed X.509 cert and populate a VMIdentity from it.
  *
  * Three checks, all must pass: the cert's own signature verifies against