Phase D: RUNCAP -- runtime capsule construction from thumbdrive content

capsule_runcap_birth() (new capsule_runcap.h/.c): builds a heap-only,
single-entry CapsuleDirHeader + CapsuleDesc + CapsuleNameEntry + arena
from a home-blocks drive's identity_src region (skipping the first
devblock, reserved for MINT's user_identity_seed_t record) and hands it
to the existing, unmodified capsule_birth_baby() -- no new birth
mechanism, matching FABRIC-3.md §F.6's own trace.

Found and closed a real gap in that trace along the way:
capsule_birth_baby()'s signature check calls capsule_get_signatures(),
which unconditionally returns the compile-time-baked global array --
meaningless for a heap-built directory, where index 0 would compare
RUNCAP's own content against whatever real capsule happens to occupy
that slot in the baked array (guaranteed-wrong, not a security check).
Added an explicit skip_pki_sig flag (0 for all 4 existing call sites,
1 for RUNCAP): that content's trust comes from CERTVERIFY, a separate
root, not the capsule-PKI chain.

Also found live: capsule_birth_baby() never sets the registry entry's
own .name (every existing caller does this itself afterward via
capsule_vm_registry_set_name() -- RUNCAP now does too), and
capsule_exec_payload() requires a "Block NNNN" header per chunk of
content or it's silently skipped, never executed -- not a bug, but
necessary context for whoever authors MINT's default personality
content next.

Added a small accessor pair (repl.h/.c) exposing the currently attached
home-blocks device/sig -- the same gap F.9's own BINDSTEP scoping had
already flagged, needed by both.

Verified end-to-end live in QEMU: synthetic identity-source content
written directly to a thumbdrive image's raw devblocks (no capsule
build, no mkcapsule) was read, compiled, and executed by a genuinely
new VM via a diagnostic RUNCAP-TEST word -- confirmed via VM-EXEC
invoking a word defined only in that source. Clean 3-architecture
regression boot (no RUNCAP drive attached) confirms no side effects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/starkernel/capsule_birth.h

@@ -127,6 +127,23 @@ CapsuleRunResult capsule_birth_mama(
  * @param descs         Capsule descriptor array
  * @param names         Capsule name entry array (parallel to descs)
  * @param arena         Capsule payload arena
+ * @param skip_pki_sig  0 for every build-time capsule (the normal case --
+ *                       checked against the compile-time-baked signature
+ *                       array via capsule_get_signatures()). Non-zero only
+ *                       for RUNCAP (FABRIC-3.md §F.6/F.18): a heap-built,
+ *                       single-entry directory sourced from a user's own
+ *                       thumbdrive has no entry in that array at all --
+ *                       index 0 would silently compare against whatever
+ *                       real capsule happens to occupy slot 0, which is
+ *                       not a security check, just a guaranteed-wrong one.
+ *                       Trust for that content comes from CERTVERIFY (a
+ *                       separate root, the user's own Zuse-signed cert)
+ *                       already having run before RUNCAP is ever called,
+ *                       not from this flag -- this only skips a check that
+ *                       was never meaningful for that content in the first
+ *                       place. Deliberately a plain flag, not a new entry
+ *                       point, so the policy is one call-site decision,
+ *                       trivially reversible.
  * @param out_vm_id     Output: assigned VM ID
  * @param out_vm_ctx    Output: new VM context
  * @return CAPSULE_RUN_OK on success, error code otherwise
@@ -137,6 +154,7 @@ CapsuleRunResult capsule_birth_baby(
     const CapsuleDesc *descs,
     const CapsuleNameEntry *names,
     const uint8_t *arena,
+    int skip_pki_sig,
     VMUuid *out_vm_id,
     void **out_vm_ctx
 );