Phase D: RUNCAP -- runtime capsule construction from thumbdrive content

capsule_runcap_birth() (new capsule_runcap.h/.c): builds a heap-only,
single-entry CapsuleDirHeader + CapsuleDesc + CapsuleNameEntry + arena
from a home-blocks drive's identity_src region (skipping the first
devblock, reserved for MINT's user_identity_seed_t record) and hands it
to the existing, unmodified capsule_birth_baby() -- no new birth
mechanism, matching FABRIC-3.md §F.6's own trace.

Found and closed a real gap in that trace along the way:
capsule_birth_baby()'s signature check calls capsule_get_signatures(),
which unconditionally returns the compile-time-baked global array --
meaningless for a heap-built directory, where index 0 would compare
RUNCAP's own content against whatever real capsule happens to occupy
that slot in the baked array (guaranteed-wrong, not a security check).
Added an explicit skip_pki_sig flag (0 for all 4 existing call sites,
1 for RUNCAP): that content's trust comes from CERTVERIFY, a separate
root, not the capsule-PKI chain.

Also found live: capsule_birth_baby() never sets the registry entry's
own .name (every existing caller does this itself afterward via
capsule_vm_registry_set_name() -- RUNCAP now does too), and
capsule_exec_payload() requires a "Block NNNN" header per chunk of
content or it's silently skipped, never executed -- not a bug, but
necessary context for whoever authors MINT's default personality
content next.

Added a small accessor pair (repl.h/.c) exposing the currently attached
home-blocks device/sig -- the same gap F.9's own BINDSTEP scoping had
already flagged, needed by both.

Verified end-to-end live in QEMU: synthetic identity-source content
written directly to a thumbdrive image's raw devblocks (no capsule
build, no mkcapsule) was read, compiled, and executed by a genuinely
new VM via a diagnostic RUNCAP-TEST word -- confirmed via VM-EXEC
invoking a word defined only in that source. Clean 3-architecture
regression boot (no RUNCAP drive attached) confirms no side effects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

src/starkernel/repl.c

@@ -67,6 +67,27 @@ static VM *g_repl_active_vm = (void *)0;
 void sk_repl_set_active_vm(VM *vm) { g_repl_active_vm = vm; }
 VM  *sk_repl_get_active_vm(void)   { return g_repl_active_vm; }
 
+/*===========================================================================
+ * Currently attached home-blocks device: mirrors g_repl_active_vm's own
+ * shape (FABRIC-3.md §F.9's own precedent for this exact accessor). Set
+ * once sk_repl_idle()'s own attach handling confirms HOMEBLOCKS_SIG_OK
+ * below; cleared on detach. RUNCAP (§F.6/§F.18) and, later, BINDSTEP's
+ * re-verify-live check (§F.9) both need this -- neither lives in this
+ * file, and usb_blk_dev/xdev below are function-static, invisible outside
+ * sk_repl_idle() without an accessor like this one.
+ *===========================================================================*/
+
+static blkio_dev_t      *g_homeblocks_dev   = (void *)0;
+static homeblocks_sig_t  g_homeblocks_sig;
+static int                g_homeblocks_sig_valid = 0;
+
+blkio_dev_t *sk_repl_get_homeblocks_dev(void) {
+    return g_homeblocks_sig_valid ? g_homeblocks_dev : (void *)0;
+}
+const homeblocks_sig_t *sk_repl_get_homeblocks_sig(void) {
+    return g_homeblocks_sig_valid ? &g_homeblocks_sig : (void *)0;
+}
+
 /*===========================================================================
  * Idle heartbeat service
  *
@@ -133,6 +154,9 @@ static void sk_repl_idle(VM *active_vm)
             switch (sig_rc) {
                 case HOMEBLOCKS_SIG_OK:
                     console_println("xhci: USB drive recognized as a home-blocks drive");
+                    g_homeblocks_dev       = &usb_blk_dev;
+                    g_homeblocks_sig       = sig;
+                    g_homeblocks_sig_valid = 1;
                     break;
                 case HOMEBLOCKS_SIG_BLANK:
                     console_println("xhci: USB drive not recognized (blank or foreign media) -- read-only general use only");
@@ -165,6 +189,10 @@ static void sk_repl_idle(VM *active_vm)
     if (xdev && xdev->bot_msc_detach_pending) {
         xdev->bot_msc_detach_pending = 0;
         blk_subsys_detach_device(&usb_blk_dev);
+        if (g_homeblocks_dev == &usb_blk_dev) {
+            g_homeblocks_dev       = (void *)0;
+            g_homeblocks_sig_valid = 0;
+        }
     }
 
     /* FABRIC.md/FABRIC-2.md Section V item 6: "a cheap 'anything dirty?