Add VMIdentity type, relocate homeblocks_sig_t off devblock 0

Phase A of the identity pipeline (FABRIC-3.md §F.2/§F.16, §F.13):

- New include/starkernel/vm_identity.h: VMIdentity{owner_pubkey[32],
  installed, acl_caps}, its own header per the project's "give real-shaped
  data its own header" convention (VMUuid's own precedent), embedded by
  value on struct VM. acl_caps is an independent capability bitmask, not
  an ordered privilege tier (decided 2026-08-28) -- Zuse isn't a
  structurally special VM, her identity just has every bit set
  (VM_IDENTITY_CAP_ALL). No individual capability bits assigned yet,
  deliberate slack matching blk_meta_t's own acl_reserved precedent --
  real bits get names once the operation they gate (BINDSTEP, MINT, ...)
  actually gets built.

- Applied the devblock-1 relocation decided in §F.13: new
  HOMEBLOCKS_SIG_START_FBLOCK constant (homeblocks_sig.h), repl.c's
  homeblocks_sig_check() call site updated from the literal 0. Also
  applied the still-owed blockmap_offset/blockmap_devblocks ->
  identity_src_offset/identity_src_devblocks rename decided in §F.6 (no
  other code referenced the old names). Updated the header's own stale
  GPT-relative doc comments to match -- GPT was dropped permanently, this
  location is final, not an interim stand-in.

Verified live on all three architectures: clean compile, clean boot to
ok>, Hermes/Artemis both confirmed live with no KILL (no regression from
last session's session-less fix). One pre-existing, unrelated anomaly
observed consistently on all three arches, not caused by this change (no
code touched here intersects Zuse's own fence-write path): "Zuse: minted
but fence write FAILED (not persistent)" -- flagged for its own
investigation, not chased here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

This commit is contained in: