proof/: complete StarForth_Double_Words.thy (arithmetic + 2>R/2R>/2R@)

Both blockers recorded at the previous resume point turned out to be
resolvable, not permanent:

- The "cell is unbounded int" blocker for D+/D-/DNEGATE/etc. was stale --
  cell was already migrated to a 64-bit word type in commit fe6e705, before
  this file was first touched. The note was never re-checked against
  current StarForth_Base.thy before being carried forward. Same lesson the
  control_words.c vm_ip finding taught one file earlier in this sweep:
  re-verify carried-forward reasoning against the current file, don't just
  trust a previous session's note.
- The missing vm->ecw_nesting field for 2>R/2R>/2R@ was a real, scoped gap
  -- added ecw_nesting :: nat to vm_state in StarForth_Base.thy.

Adds S>D, D+, D-, DNEGATE, DABS, a d_compare helper, DMAX, DMIN, D<, D=,
D0=, D0<, D2*, D2/, 2>R, 2R>, 2R@. D2*/D2/ use push_bit/drop_bit/bit
(established idiom from StarForth_Q48_16.thy) for the 128-bit shifts; D2/
uses sint/div (floor division) rather than cell_sdiv (C99 truncating
division) since arithmetic right shift is floor division, not truncation,
for negative operands. DNEGATE's double-negation-is-identity property is
true but left unproved (needs the same carry/borrow-across-the-pair
algebra as D+/D-, not just simp) -- a nice-to-have, not core plumbing.

All 20 registered words in double_words.c are now covered. 28 theory
files verify with zero errors.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Base.thy

@@ -509,6 +509,11 @@ record vm_state =
   vm_base       :: cell                           \<comment> \<open>numeric base for I/O (2..36)\<close>
   vm_error      :: bool
   vm_halted     :: bool
+  (* ○ CODE-MUST-MATCH: C: int ecw_nesting (include/vm.h:390) -- depth of
+     execute_colon_word call stack; >0 means inside a colon word. Modeled as
+     nat (C only ever tests ecw_nesting > 0, never negative values in any
+     reachable path) -- see StarForth_Double_Words.thy's 2>R/2R>/2R@. *)
+  ecw_nesting   :: nat
 
   (* ── Physics Loop #1: Execution heat tracking ───────────────────────── *)
   (* ○ CODE-MUST-MATCH: heat_threshold_{25th,50th,75th} in C VM struct.