§H.12 step 20: CH-REQUEST initiator-only gate (MY-CH-ID)

Added VARIABLE MY-CH-ID to messaging.4th (fail-closed -1 default) and
set it per-VM in hermes/init.4th and artemis/init.4th. CH-REQUEST now
refuses if the caller-supplied 'from' doesn't match the calling VM's
own id, closing a real spoofing gap found while implementing this.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QgooKd5hJNtTYqB6CyK5f9

capsules/common/messaging.4th

@@ -42,6 +42,7 @@ VARIABLE MBR-FREE-HEAD
 VARIABLE MSG-SEQ
 VARIABLE CH-ACTIVE
 VARIABLE COMMON-CH
+VARIABLE MY-CH-ID
 Block 5006
 ( VM name routing table -- same fixed table every VM loads, )
 ( so IDX>NAME resolves identically everywhere. )
@@ -351,7 +352,10 @@ Block 5031
 : CH-MINT-ID ( owner -- id )
   MSG-SEQ @ 1+ DUP MSG-SEQ !
   SWAP 32 LSHIFT OR ;
+( H.8: initiator-only gate. Refuses if `from` doesn't )
+( match MY-CH-ID -- no posting while claiming another VM. )
 : CH-REQUEST ( type from to paddr plen -- )
+  3 PICK MY-CH-ID @ <> IF 2DROP 2DROP DROP EXIT THEN
   COMMON-CH @ CH-STATE@ CH-OPEN = IF
     COMMON-CH @ MSG-SEND
   ELSE 2DROP 2DROP DROP THEN ;
@@ -385,7 +389,7 @@ Block 5033
   MBR-INIT-FREE
   0 MSG-SEQ !
   0 MSG-LAST-MSG !
-  0 CH-ACTIVE !
+  0 CH-ACTIVE !  -1 MY-CH-ID !
   COMMON-INIT
   VM-NAMES-INIT ;
 Block 5034