Console-VM + user-VM pair: real async message-passing relay

Console sessions now route through the same general VM-to-VM messaging
system (Phase C) any VM can already use for its own reasons -- not a
synchronous shortcut. Per direct instruction: real async MSG-SEND/
MSG-DELIVER (Option B), not a VM-EXEC-based synchronous relay, because
messaging is a general capability, not a console-specific mechanism.

New CONSOLE-CMD-EVENT message type (common:messaging.4th). New
sk_repl_dispatch_line() (repl.c), called from both sk_repl_step and
sk_repl_run in place of a direct vm_interpret(): if the active VM's own
name has a live "<name>~user" counterpart registered, the raw input
line is wrapped as an S"-embedded CONSOLE-CMD-EVENT MSG-SEND and
interpreted on the console VM instead of being run directly -- the
console's own next MSG-TICK (Hera's idle pump) delivers it into the
paired user VM via VM-EXEC, same mechanism every other message already
uses. Falls back to direct interpretation if there's no pairing, or if
the line contains a `"` (known v1 limitation, warned about explicitly
rather than silently mishandled).

New capsule_console_birth() (capsule_console.h/.c): a bare VM whose
only content is loading common:messaging.4th -- the console side of a
pairing, parallel in shape to RUNCAP's user-VM birth but with fixed
embedded content instead of a devblock read (no identity, no thumbdrive
involved). New PAIR-TEST diagnostic word (mama_forth_words.c, matches
RUNCAP-TEST's own precedent): births both halves of a pairing and
registers the "<name>~user" mapping. Not the real pairing call site --
that's the eventual attach/onboarding flow -- this exists to exercise
the relay live before that flow exists.

Found and fixed a real, serious bug live: console_set_vm_name() stored
the caller's raw pointer instead of copying it. mama_word_use() (USE)
passes a VMRegistryEntry field living on its own stack frame -- once
USE returns, that pointer dangles, corrupting every console tag after
the first USE (observed directly as garbled "[[]" / binary-looking
prefixes instead of "[CaptBob]"). Fixed at the source: console_set_
vm_name() now copies into internal storage. That surfaced a second,
related bug across every console_get_vm_name()-based save/restore call
site in mama_forth_words.c (BIRTH, VM-STEP, VM-EXEC, CONNECT-HERMES,
CONNECT-ARTEMIS): saving just a pointer into the single internal buffer
meant an intervening console_set_vm_name() call silently corrupted the
saved value before the restore ever ran. New console_save_vm_name()
copies into caller-owned storage; every save/restore site updated.

Verified end-to-end, live in QEMU: typed WELCOME at a paired console
VM -- it did not execute directly (no UNKNOWN WORD), printed ok
immediately (queued, async), and on the next idle tick
"[CaptBob~user] Minted identity -- default personality" appeared on
its own -- genuine delivery and execution in the paired user VM through
the real MSG-SEND/MSG-DELIVER pipeline. Console tags confirmed clean
(no garbling) across all three architectures' full regression boot.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

src/starkernel/hal/console.c

@@ -160,18 +160,50 @@ static int serial_transmit_empty(void) {
 }
 #endif
 
-/* Active VM name for [Name] line prefix; NULL = no prefix */
+/* Active VM name for [Name] line prefix; NULL = no prefix.
+ *
+ * g_active_vm_name_buf owns the storage -- console_set_vm_name() copies
+ * into it rather than storing the caller's own pointer. Found live
+ * 2026-08-28 (FABRIC-3.md Phase F): mama_word_use() (USE) passes
+ * entry.name, a local VMRegistryEntry's own field -- once USE returns,
+ * that stack frame is reused and the old raw-pointer version left
+ * g_active_vm_name dangling, corrupting every console tag after the
+ * first USE (observed as garbled "[[]"/binary-looking prefixes). A
+ * caller passing a string literal (e.g. console_set_vm_name("Hermes"))
+ * was always safe; this fixes every caller uniformly instead of relying
+ * on each one happening to pass static storage. */
+#define CONSOLE_VM_NAME_BUF 64
+static char        g_active_vm_name_buf[CONSOLE_VM_NAME_BUF];
 static const char *g_active_vm_name = (void *)0;
 static int         g_line_start     = 1;
 
 void console_set_vm_name(const char *name) {
-    g_active_vm_name = name;
+    /* Empty string treated the same as NULL: console_save_vm_name()
+     * writes "" for "there was no active name," so this keeps that
+     * round-trip correct (save-empty then restore-empty must mean
+     * "still no prefix," not "prefix is now the empty string"). */
+    if (!name || !name[0]) { g_active_vm_name = (void *)0; return; }
+    size_t i;
+    for (i = 0; i < CONSOLE_VM_NAME_BUF - 1u && name[i]; i++)
+        g_active_vm_name_buf[i] = name[i];
+    g_active_vm_name_buf[i] = '\0';
+    g_active_vm_name = g_active_vm_name_buf;
 }
 
 const char *console_get_vm_name(void) {
     return g_active_vm_name;
 }
 
+void console_save_vm_name(char *out, size_t cap) {
+    if (!out || cap == 0) return;
+    size_t i = 0;
+    if (g_active_vm_name) {
+        for (; i < cap - 1u && g_active_vm_name[i]; i++)
+            out[i] = g_active_vm_name[i];
+    }
+    out[i] = '\0';
+}
+
 /* Raw single-character write — no prefix logic, called by emit_prefix() */
 static void raw_putc(char c) {
 #if defined(__aarch64__)