Fix EXECUTE/?/DUMP/TYPE/DECIMAL-HEX-OCTAL/ALIGN defects from proof sweep

proof/FINDINGS.md's Isabelle/HOL word-source sweep (§4) flagged five real
defects; this fixes all five and records resolution in that doc:

- EXECUTE (system_words.c): cast a popped cell straight to a DictEntry*
  and called through it with only a null check. Now validates via a new
  shared vm_dict_entry_ok(), promoted out of starforth_words.c's
  ENTROPY@/ENTROPY! guard (dictionary_management.c) so EXECUTE gets the
  same live-entry check.

- ? and DUMP (format_words.c): dereferenced the popped cell as a raw host
  pointer, bypassing vm_addr_ok entirely (out-of-VM-bounds read). Both now
  go through VM_ADDR/vm_addr_ok/vm_load_cell/vm_ptr like every other
  memory word (@, `,`, editor_words.c).

- TYPE (io_words.c): bounds check computed addr+count in signed 64-bit
  arithmetic, which can overflow and bypass the check on large operands.
  Replaced with vm_addr_ok(), which is written to avoid that overflow.

- DECIMAL/HEX/OCTAL (format_words.c): wrote only the BASE memory cell,
  never vm->base, the host-mirror field number-output words actually read
  via current_base() -- so these words silently affected number parsing
  but never printing. Now call the existing vm_set_base() (previously
  only used at boot init), which updates both. vm_get_base/vm_set_base
  promoted to public declarations in include/vm.h.

- ALIGN vs ALLOT/,/C,/2, (dictionary_words.c): disagreed on dictionary
  growth ceiling (2MB vs 5MB). Investigated which was correct rather than
  blindly widening: vm_get_block_addr() maps block N to
  vm->memory + N*BLOCK_SIZE across the full 5MB arena, and
  USER_BLOCKS_START (block 2048) lines up exactly with
  DICTIONARY_MEMORY_SIZE -- so ALLOT/,/C,/2, letting `here` grow past 2MB
  could silently corrupt live block/user data sharing that memory.
  Tightened ALLOT/,/C,/2, to DICTIONARY_MEMORY_SIZE to match ALIGN.

Verified: hosted (amd64) and kernel (amd64, __STARKERNEL__) both build
clean with -Wall -Werror; hosted POST suite 1012/1012 passing (0
regressions); manually exercised EXECUTE, ?/DUMP, TYPE, HEX/DECIMAL/OCTAL,
and large-ALLOT rejection in the REPL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Qf6YcnHgaEtEygq3knx19

include/vm.h

@@ -138,6 +138,13 @@ void vm_store_u8(struct VM* vm, vaddr_t addr, uint8_t v);
 cell_t vm_load_cell(struct VM* vm, vaddr_t addr); /* requires alignment */
 void vm_store_cell(struct VM* vm, vaddr_t addr, cell_t v);
 
+/* Numeric BASE accessors: keep the FORTH-visible BASE cell (vm->base_addr)
+ * and the host-mirror field (vm->base, read by number-output words via
+ * current_base()) in sync. Always use these instead of writing base_addr
+ * directly. */
+unsigned vm_get_base(const struct VM* vm);
+void vm_set_base(struct VM* vm, unsigned b);
+
 /* Explicit stack<->offset conversions (keep intent obvious) */
 static inline vaddr_t VM_ADDR(cell_t c) { return (vaddr_t)(uint64_t)c; }
 static inline cell_t CELL(vaddr_t a) { return (cell_t)(int64_t)a; }
@@ -638,6 +645,12 @@ DictEntry* vm_dictionary_find_latest_by_func(VM* vm, word_func_t func);
 
 DictEntry* vm_dictionary_lookup_by_word_id(VM* vm, uint32_t word_id);
 
+/* Validate that `candidate` is a live, currently-registered dictionary entry
+ * for this VM (walks vm->latest under dict_lock; never dereferences an
+ * unverified pointer). Use before executing/inspecting through any xt/addr
+ * popped off the data stack (EXECUTE, ENTROPY@/!, etc). */
+int vm_dict_entry_ok(VM* vm, DictEntry* candidate);
+
 void vm_dictionary_track_entry(VM* vm, DictEntry* entry);
 
 void vm_dictionary_untrack_entry(VM* vm, DictEntry* entry);