proof/: close the data-field (DF) gap for CREATE/VARIABLE/CONSTANT

Adds de_df :: cell to dict_entry (StarForth_Base.thy) -- the DF cell
modelled as a plain value, closing gap (b) for every word that only
reads/writes it through its OWNING entry. Confirmed by grep this record
has exactly one construction site in the whole 52-theory suite
(dict_insert_entry), so the field addition's blast radius is contained
to StarForth_Defining_Words.thy alone -- full suite still verifies
unchanged elsewhere.

dict_write_df writes an existing entry's DF by word_id. forth_create_full/
forth_variable_full/forth_constant_full now compose the DF write in,
making CREATE/VARIABLE/CONSTANT the first three FULLY modelled words in
this file (guard through parse through insertion through the DF write --
nothing left unmodelled per word except the pin-shadow name-scan guard,
sidestepped the same way as everywhere else in this suite).

Their runtime companions (defining_runtime_create/_variable/_constant --
confirmed byte-identical C bodies) share one new definition,
forth_runtime_read_df, gated on ds_full matching vm_push's real internal
check. Required adding current_executing_word_id to vm_state (mirrors
vm->current_executing_entry, word-id-indexed like latest_id).

DEFER and : remain at their previous closure level: DEFER's DF write was
already implicitly closed (de_df=0 at creation matches its explicit
*df=0), but its own runtime is a fundamentally different DF usage
(dispatch reassignment via a stored pointer, gap c, not a plain value);
: has no vm_state field for vm->compiling_word tracking.

Full suite (54 theories) verifies green.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Base.thy

@@ -300,6 +300,19 @@ record dict_entry =
   de_acl_allow   :: bool    \<comment> \<open>acl_allow: cached decision (True=allow, False=deny)\<close>
   de_acl_mode    :: nat     \<comment> \<open>acl_mode: 0=TTL, 1=STRICT\<close>
   de_acl_pinned  :: bool    \<comment> \<open>acl_pinned: one-way ratchet; True = immutable\<close>
+  (* ○ CODE-MUST-MATCH, added 2026-08-15: the entry's data-field (DF) cell
+     -- the storage C's `vm_dictionary_get_data_field(entry)` returns a
+     pointer into (a single cell_t immediately following the entry's name
+     in the arena, per vm_create_word's layout, dictionary_management.c:
+     406-410). Modelled here as a plain VALUE (`cell`), not an address --
+     this closes gap (b) for every word that only ever reads/writes the DF
+     as a value through its OWNING entry (CREATE/VARIABLE/CONSTANT/DEFER
+     and their runtimes). It does NOT close >BODY/>NAME-style words in
+     StarForth_Dictionary_Manipulation_Words.thy, which need the DF's
+     ADDRESS (so a later, unrelated `@`/`!` could target it generically)
+     -- this model has no notion of a dict_entry's own address, only its
+     word_id, so that remains a distinct, still-open gap. *)
+  de_df          :: cell
 
 (* ── Word transition metrics ─────────────────────────────────────────────── *)
 (* ○ CODE-MUST-MATCH: struct WordTransitionMetrics in include/physics_pipelining_metrics.h
@@ -501,6 +514,13 @@ record vm_state =
   dict_fence    :: "nat option"                   \<comment> \<open>FENCE word_id for FORGET\<close>
   dict_lock     :: lock_state
   word_id_next  :: nat
+  (* ○ CODE-MUST-MATCH, added 2026-08-15: C `DictEntry* vm->
+     current_executing_entry` (include/vm.h:434) -- the entry currently
+     executing, read by runtime helpers like `defining_runtime_create`/
+     `_variable`/`_constant` via `vm->current_executing_entry` rather than
+     a fresh lookup. Modelled word-id-indexed (`nat option`), matching
+     `latest_id`'s convention, rather than as a raw pointer. *)
+  current_executing_word_id :: "nat option"
 
   (* ── Execution state ──────────────────────────────────────────────────── *)
   vm_mode       :: vm_mode