Add VMIdentity type, relocate homeblocks_sig_t off devblock 0

Phase A of the identity pipeline (FABRIC-3.md §F.2/§F.16, §F.13):

- New include/starkernel/vm_identity.h: VMIdentity{owner_pubkey[32],
  installed, acl_caps}, its own header per the project's "give real-shaped
  data its own header" convention (VMUuid's own precedent), embedded by
  value on struct VM. acl_caps is an independent capability bitmask, not
  an ordered privilege tier (decided 2026-08-28) -- Zuse isn't a
  structurally special VM, her identity just has every bit set
  (VM_IDENTITY_CAP_ALL). No individual capability bits assigned yet,
  deliberate slack matching blk_meta_t's own acl_reserved precedent --
  real bits get names once the operation they gate (BINDSTEP, MINT, ...)
  actually gets built.

- Applied the devblock-1 relocation decided in §F.13: new
  HOMEBLOCKS_SIG_START_FBLOCK constant (homeblocks_sig.h), repl.c's
  homeblocks_sig_check() call site updated from the literal 0. Also
  applied the still-owed blockmap_offset/blockmap_devblocks ->
  identity_src_offset/identity_src_devblocks rename decided in §F.6 (no
  other code referenced the old names). Updated the header's own stale
  GPT-relative doc comments to match -- GPT was dropped permanently, this
  location is final, not an interim stand-in.

Verified live on all three architectures: clean compile, clean boot to
ok>, Hermes/Artemis both confirmed live with no KILL (no regression from
last session's session-less fix). One pre-existing, unrelated anomaly
observed consistently on all three arches, not caused by this change (no
code touched here intersects Zuse's own fence-write path): "Zuse: minted
but fence write FAILED (not persistent)" -- flagged for its own
investigation, not chased here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/starkernel/vm_identity.h

@@ -0,0 +1,90 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/**
+ * vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-3.md
+ * §F.2/§F.16, decided 2026-08-27/28)
+ *
+ * Holds only what a VM needs to prove *who owns it* and *what that owner
+ * is allowed to do* -- never a private key. A regular VM's lock never
+ * signs anything itself, so no seed/private material belongs here at all
+ * (unlike Zuse's own zuse_cert_seed/zuse_cert_pubkey pair, which does need
+ * one because she actively signs). Deliberately its own header rather
+ * than inline fields on struct VM, mirroring VMUuid's own precedent
+ * (vm_uuid.h) -- standing instruction: give real-shaped data its own
+ * header and integrate as a field, don't grow struct VM ad hoc.
+ *
+ * acl_caps is a capability bitmask, not an ordered privilege tier
+ * (decided 2026-08-28) -- independent bits, not a nested hierarchy. Zuse
+ * is not a structurally special VM: her identity just has every bit set.
+ * No bit values are assigned yet -- deliberate slack, per this project's
+ * "flexibility until we understand the recipe" precedent (see
+ * blk_meta_t's own acl_reserved bytes, FABRIC-3.md §F.4) -- real bits get
+ * names only once the operation they gate actually gets built (BINDSTEP,
+ * MINT, ...), not speculatively here.
+ */
+
+#ifndef STARKERNEL_VM_IDENTITY_H
+#define STARKERNEL_VM_IDENTITY_H
+
+#ifdef __STARKERNEL__
+
+#include <stdint.h>
+
+typedef struct {
+    uint8_t  owner_pubkey[32]; /**< Ed25519 public key of this VM's owning
+                                 *   identity. Meaningless unless installed
+                                 *   is set. */
+    uint8_t  installed;        /**< 0 = no identity installed yet (e.g.
+                                 *   Hera/Hermes/Artemis today, before
+                                 *   D.5's per-VM-identity work lands) --
+                                 *   BINDSTEP-style checks must treat this
+                                 *   as "no lock, allow freely," matching
+                                 *   §F.9 decision 2. 1 = owner_pubkey/
+                                 *   acl_caps are real. */
+    uint32_t acl_caps;         /**< Capability bitmask. All-zero until a
+                                 *   real caller defines and checks a bit;
+                                 *   VM_IDENTITY_CAP_ALL for Zuse's own
+                                 *   identity ("her ACL just grants
+                                 *   everything," not a special VM type). */
+} VMIdentity;
+
+/** Every capability bit set -- Zuse's own identity uses this, not a
+ *  distinct "is this Zuse" flag anywhere else in the system. */
+#define VM_IDENTITY_CAP_ALL 0xFFFFFFFFu
+
+/**
+ * vm_identity_has_cap - Check whether an installed identity holds a
+ * capability. Returns 0 (denied) if identity isn't installed at all --
+ * callers that mean "no lock, allow freely" (§F.9 decision 2) must check
+ * installed themselves first, not call this and treat 0 as a denial in
+ * that case.
+ *
+ * @param id   Identity to check.
+ * @param cap  A single capability bit (or bits) to test for.
+ * @return     Non-zero if id is installed and every bit in cap is set.
+ */
+int vm_identity_has_cap(const VMIdentity *id, uint32_t cap);
+
+#endif /* __STARKERNEL__ */
+
+#endif /* STARKERNEL_VM_IDENTITY_H */