Retire emergency CLI: Zuse goes thumbdrive-resident, ACL.4th activated

Three tightly-coupled changes, verified together per Captain Bob's own
"getting rid of the emergency cli" direction:

1. Zuse's identity is thumbdrive-resident, never system-resident. New
   zuse_genesis_marker_t (magic/version/zuse_pubkey[32]/crc) replaces
   zuse_cert_devblock_t's slot in the top-of-device fence -- the system
   now remembers only that a root identity exists and its pubkey, never
   a seed. zuse_cert_devblock_t is kept in the repo, marked superseded,
   no longer written by any code path.

   capsule_mint_identity() grows a genesis mode (issuer_vm=NULL): no
   cert is built or written (Zuse isn't verified against a separate
   signer -- she's recognized by pubkey match against the marker) and
   two new optional out-params (out_pubkey/out_seed) let the caller
   install the cert immediately after a genesis mint.

   New capsule_zuse_boot_try_attach() (capsule_zuse_boot.c), called
   from sk_repl_idle() on every fresh USB attach (the only point in the
   boot lifecycle a thumbdrive can actually be detected -- attach
   polling doesn't exist yet at kernel_main.c's old one-shot mint point,
   which is why that whole block is gone): no marker + blank drive ->
   genesis-mint; marker present + matching drive -> read its own
   user_identity_seed_t, install the cert. Either way, re-runs
   ACL-ZUSE-BOOT (zuse.4th) so zuse_session activates exactly like it
   always has for a same-boot cert install -- ACL-PIN only blocks
   redefinition, not re-execution, so no new C-side auth logic needed.

2. ACL.4th activated (capsules/init.4th) -- inactive all session until
   now. Found and fixed a real bug this immediately surfaced: zuse.4th's
   ACL-ZUSE-BOOT tried `['] ACL-ZUSE-BOOT ACL-PIN` from inside its own
   still-compiling definition -- the word isn't findable yet at that
   point, so the whole definition silently failed to compile every
   previous boot this session (dormant, since ACL.4th never loaded).
   Fixed: pin after the definition closes, not from within it -- it
   only needs to happen once anyway, and pinning doesn't block the
   re-invocation genesis/attach needs.

3. The unauthenticated emergency-CLI ACL bypass is retired
   (repl.c): `emergency_console = is_hera ? (zuse_session ? 0 : 1) : 0`
   deleted from both sk_repl_step and sk_repl_run. Every word run from
   Hera's own bare prompt now goes through ordinary ACL enforcement;
   emergency_console is driven only by the genuine C-level fault
   handler again.

Added ZUSE-SESSION? (starforth_words.c), a read-only diagnostic
matching ZUSE-PUBKEY@'s own precedent, to verify the whole chain
directly rather than by inference.

Verified end-to-end live in QEMU: fresh boot, no thumbdrive ->
ZUSE-SESSION? reads 0. Attach a genuinely blank drive via QMP -> genesis
mint fires automatically (no typing) -> ZUSE-SESSION? reads -1 (true).
Hermes/Artemis both birth clean on all three architectures with ACL
now actually enforced for the first time all session -- no denials, no
UNKNOWN WORD beyond the deliberate POST self-test cases.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/starkernel/zuse_genesis_marker.h

@@ -0,0 +1,46 @@
+/*
+ * zuse_genesis_marker.h -- on-disk record format for the system-resident
+ * "a root Zuse identity already exists" marker (FABRIC-3.md §F.21),
+ * stored in devblock_from_top=0 of the top-of-device system-metadata
+ * fence (block_subsystem.h's blk_meta_zone_read()/write(), same location
+ * zuse_cert_devblock_t used to occupy).
+ *
+ * Supersedes zuse_cert_devblock_t (zuse_cert_devblock.h, kept in the repo
+ * as historical record, no longer written): that type stored Zuse's own
+ * *seed* system-resident. Under the thumbdrive-resident Zuse design
+ * (§F.20/§F.21), the seed lives only on Zuse's own minted thumbdrive --
+ * this record deliberately holds only her *public* key, enough to (a)
+ * know genesis has already happened, so a second blank thumbdrive
+ * attached on some later boot never mints a second competing root, and
+ * (b) recognize which attached identity is genuinely hers. Losing this
+ * fence record is not a security problem (it's not a secret); losing the
+ * thumbdrive itself is what actually loses the identity.
+ */
+#ifndef STARKERNEL_ZUSE_GENESIS_MARKER_H
+#define STARKERNEL_ZUSE_GENESIS_MARKER_H
+
+#include <stdint.h>
+
+#define ZUSE_GENESIS_MARKER_MAGIC \
+    ((uint32_t)'Z' | ((uint32_t)'G' << 8) | ((uint32_t)'E' << 16) | ((uint32_t)'N' << 24))
+
+#define ZUSE_GENESIS_MARKER_VERSION 1u
+
+typedef struct {
+    uint32_t magic;       /* ZUSE_GENESIS_MARKER_MAGIC; anything else means
+                            * "genesis has not happened yet" (blank/foreign
+                            * bytes), not a format-corruption error. */
+    uint32_t version;     /* ZUSE_GENESIS_MARKER_VERSION */
+    uint8_t  zuse_pubkey[32]; /* Ed25519 public key of the root Zuse
+                            * identity minted at genesis. No seed here --
+                            * that lives only on Zuse's own thumbdrive. */
+    uint64_t crc;         /* CRC-64/ISO (block_subsystem.h's compute_crc64())
+                            * over every byte of this struct up to (not
+                            * including) this field. */
+    uint8_t  _pad[4096 - (4 + 4 + 32 + 8)];
+} zuse_genesis_marker_t;
+
+_Static_assert(sizeof(zuse_genesis_marker_t) == 4096,
+               "zuse_genesis_marker_t must be exactly one 4 KiB devblock");
+
+#endif /* STARKERNEL_ZUSE_GENESIS_MARKER_H */