proof/: close the data-field (DF) gap for CREATE/VARIABLE/CONSTANT

Adds de_df :: cell to dict_entry (StarForth_Base.thy) -- the DF cell
modelled as a plain value, closing gap (b) for every word that only
reads/writes it through its OWNING entry. Confirmed by grep this record
has exactly one construction site in the whole 52-theory suite
(dict_insert_entry), so the field addition's blast radius is contained
to StarForth_Defining_Words.thy alone -- full suite still verifies
unchanged elsewhere.

dict_write_df writes an existing entry's DF by word_id. forth_create_full/
forth_variable_full/forth_constant_full now compose the DF write in,
making CREATE/VARIABLE/CONSTANT the first three FULLY modelled words in
this file (guard through parse through insertion through the DF write --
nothing left unmodelled per word except the pin-shadow name-scan guard,
sidestepped the same way as everywhere else in this suite).

Their runtime companions (defining_runtime_create/_variable/_constant --
confirmed byte-identical C bodies) share one new definition,
forth_runtime_read_df, gated on ds_full matching vm_push's real internal
check. Required adding current_executing_word_id to vm_state (mirrors
vm->current_executing_entry, word-id-indexed like latest_id).

DEFER and : remain at their previous closure level: DEFER's DF write was
already implicitly closed (de_df=0 at creation matches its explicit
*df=0), but its own runtime is a fundamentally different DF usage
(dispatch reassignment via a stored pointer, gap c, not a plain value);
: has no vm_state field for vm->compiling_word tracking.

Full suite (54 theories) verifies green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/COVERAGE.md

@@ -70,7 +70,7 @@ library itself is separately covered by `StarForth_Q48_16.thy`).
 | `format_words.c` | `StarForth_Format_Words.thy` | 17/19 (`#`/`#S` multi-precision division deferred) |
 | `system_words.c` | `StarForth_System_Words.thy` | 10/16 + `(ABORT")` helper |
 | `vocabulary_words.c` | `StarForth_Vocabulary_Words.thy` | 1/7 partial (entire subsystem is file-scope statics, see FINDINGS.md §1) |
-| `defining_words.c` | `StarForth_Defining_Words.thy` | 4/19 full + `;` guard-only + `:`/CREATE/VARIABLE/CONSTANT full up to the DF write (added 2026-08-14/15) |
+| `defining_words.c` | `StarForth_Defining_Words.thy` | 7/19 fully modelled (original 4 + CREATE/VARIABLE/CONSTANT and their runtimes) + `;` guard-only + `:` full except `compiling_word` tracking (added 2026-08-14/15) |
 | `acl_words.c` | `StarForth_ACL_Words.thy` | 7/12 (5 already covered by the pre-existing `ACL_*.thy` policy theories) |
 | `dictionary_heat_diagnostic_words.c` | `StarForth_Dictionary_Heat_Diagnostic_Words.thy` | 4/6 full + 1 partial |
 | `physics_freeze_words.c` | `StarForth_Physics_Freeze_Words.thy` | 6/9 |
@@ -116,20 +116,30 @@ effort on the scale of what's already here:
   the abstract `dict_entry` model is word-id-indexed, not addressed; no
   independent `dsp` register exists to model `SP@`/`SP!` against either.
 - **Dictionary insertion** (`vm_create_word`, used by `:`, CREATE, VARIABLE,
-  CONSTANT, DEFER) — **partially closed 2026-08-14/15.** `dict_insert_entry`
-  (`StarForth_Defining_Words.thy`) models the word_id-assignment/
-  dictionary-table/`latest_id`/`word_id_next`-counter portion. All five
-  words now have a `forth_*_full` definition composing the real parse,
-  any word-specific guard (CONSTANT's stack-underflow check, `:`'s
-  nested-definition check), any align/allot step (CREATE's `vm_align`,
-  VARIABLE's `vm_align` + a new `forth_vm_allot_raw` modelling the raw
-  `vm_allot` C helper), and the entry insertion itself, all the way up
-  to — but not including — the data-field write. Still not modelled for
-  any of the five: `vm->compiling_word` tracking (no vm_state field),
-  the data-field (DF) write each word does afterward (still gap (b)
-  below), and the pin-shadow name-scan guard (sidestepped via an explicit
-  `pinned_conflict :: bool` parameter, same technique as the XT-pop gap
-  elsewhere in this suite).
+  CONSTANT, DEFER) — **closed end-to-end for CREATE/VARIABLE/CONSTANT,
+  2026-08-14/15**, `:`/DEFER closed up to `vm->compiling_word` tracking.
+  `dict_insert_entry` (`StarForth_Defining_Words.thy`) models the
+  word_id-assignment/dictionary-table/`latest_id`/`word_id_next`-counter
+  portion; `de_df :: cell` (added to `dict_entry` in `StarForth_Base.thy`)
+  and `dict_write_df` close the data-field (DF) write gap (b) for every
+  word that treats DF as a plain value. Each of the five words' `forth_
+  *_full` definition now composes the real parse, any word-specific guard
+  (CONSTANT's stack-underflow check, `:`'s nested-definition check), any
+  align/allot step (CREATE's `vm_align`; VARIABLE's `vm_align` +
+  `forth_vm_allot_raw`, modelling the raw `vm_allot` C helper distinctly
+  from the FORTH word ALLOT), the entry insertion, AND the DF write —
+  CREATE/VARIABLE/CONSTANT are now fully modelled words, the first three
+  in this entire file. Their runtime companions (`defining_runtime_
+  create`/`_variable`/`_constant` — byte-identical C bodies) share one
+  new definition, `forth_runtime_read_df`, which also required adding
+  `current_executing_word_id` to `vm_state` (mirrors `vm->
+  current_executing_entry`). Still open: `:`'s `vm->compiling_word`
+  tracking (no vm_state field, so `:` stops just short of full closure);
+  DEFER's own runtime (dispatch reassignment via a stored pointer — a
+  fundamentally different DF usage, still gap (c)); IS/DEFER@ (need the
+  FIND-family name-resolution gap first); and the pin-shadow name-scan
+  guard everywhere (sidestepped via an explicit `pinned_conflict :: bool`
+  parameter, same technique as the XT-pop gap elsewhere in this suite).
 - **The vocabulary chain mechanics** (VOCABULARY/DEFINITIONS/CONTEXT/CURRENT/
   FORTH) — file-scope statics, see FINDINGS.md §1, instance #5.
 - **The hot-words cache** (`physics_benchmark_words.c`) and **the bucket/