proof/: add StarForth_Editor_Words.thy and StarForth_Format_Words.thy

editor_words.c: zero tractable words (first such file in this sweep) --
every word routes through the same deferred block-window cache as
block_words.c, and EDIT is an interactive stdin/stdout REPL loop, not a
single-step transition.

format_words.c: 17 of 19 registered words modeled (# and #S deferred,
multi-precision division out of scope). Two genuine C findings recorded:
(1) DECIMAL/HEX/OCTAL write only the FORTH-visible memory cell at
base_addr, never the separate vm->base host-mirror field that number
OUTPUT words actually read -- proved formally
(decimal_does_not_change_vm_base et al.), so HEX/OCTAL/DECIMAL silently
never affect printed output, only parsed input. (2) ? and DUMP cast the
popped cell directly to a host pointer and dereference it, bypassing
vm_addr_ok entirely -- an out-of-VM-bounds read, not modeled since it
isn't a vm->memory access at all.

Adds base_addr/hold_addr/hold_pos to vm_state (StarForth_Base.thy),
matching the scr_addr/here pattern from earlier files.

proof/StarForth_Base.thy

@@ -519,6 +519,18 @@ record vm_state =
      block number. Modeled as nat, matching `here`'s convention for VM
      addresses. See StarForth_Block_Words.thy's SCR. *)
   scr_addr      :: nat
+  (* ○ CODE-MUST-MATCH: C: vaddr_t base_addr (include/vm.h:453) -- VM address
+     of the FORTH BASE variable cell; vaddr_t hold_addr (include/vm.h:454) --
+     VM address of the 64-byte pictured-number hold buffer; int hold_pos
+     (include/vm.h:455) -- current fill count in that buffer, 0..63.
+     `vm_base` (above) is the SEPARATE host-mirror cell_t field C reads for
+     number *output* formatting (format_words.c's current_base()); the cell
+     at `base_addr` is what number *parsing* reads (vm.c's vm_get_base()).
+     See StarForth_Format_Words.thy for the finding that these two can
+     desync. *)
+  base_addr     :: nat
+  hold_addr     :: nat
+  hold_pos      :: nat
 
   (* ── Physics Loop #1: Execution heat tracking ───────────────────────── *)
   (* ○ CODE-MUST-MATCH: heat_threshold_{25th,50th,75th} in C VM struct.