Phase E: MINT -- real keypair, Zuse-signed DER cert, working default identity

capsule_mint_identity() (new capsule_mint.h/.c): mints a fresh identity
onto a blank/unminted thumbdrive -- real Ed25519 keypair from virtio_rng,
a fresh drive_uuid (independent random draw, not derived from the
identity seed, per FABRIC-3.md §F.8 decision 3), a Zuse-signed DER cert
in the CERTVERIFY format, and a small working default personality (a
real WELCOME word, not a stub -- FABRIC-3.md §F.6/§F.8's own "default
personality content" question stays open, but whatever mints today must
actually do something when RUNCAP births it). Refuses to overwrite a
drive that already reads as a recognized home-blocks drive, mirroring
WRITE(10)'s own refuse-on-non-blank posture (decided now, not just
"reasonable by analogy" as §F.8 left it).

x509_build_user_cert() (x509_ed25519.h/.c): the encode-side counterpart
to the existing decode functions (x509_extract_ed25519_pubkey(),
x509_verify_signature(), x509_extract_serial()) -- a minimal DER TLV
writer producing exactly the fields those functions read. Host-tested
round-trip against the real decoder before trusting it in the kernel,
including a high-bit-serial case that exercises the DER integer-padding
rule; all assertions pass (pubkey/serial round-trip, signature verifies
against the real issuer, correctly rejects the wrong key and a
corrupted signature).

New user_identity_seed_t (user_identity_seed.h): the on-disk record for
a minted identity's own keypair, same magic+version+fields+pad-to-4096+
real-CRC convention as zuse_cert_devblock_t and homeblocks_sig_t. Fixed
devblock layout: sig(1), cert(2), seed record(3), default personality(4).

New MINT word (mama_forth_words.c) and a small accessor
(sk_repl_get_attached_blk_dev(), repl.h/.c) exposing the currently
attached USB device regardless of home-blocks recognition -- MINT's own
target is a blank drive, which by definition never sets Phase D's
sk_repl_get_homeblocks_dev().

Verified end-to-end live in QEMU: MINT on a genuinely blank test drive,
then (after a detach/reattach so the sig cache picks up the fresh
header -- a known workflow gap, not fixed here, flagged for whoever
builds the real Console onboarding flow) RUNCAP birthed a VM from that
drive's own newly-minted content, and VM-EXECing its WELCOME word
printed the default personality banner. The full mint-to-birth Tripod
identity flow works end to end for the first time. Clean 3-architecture
regression boot confirms no side effects on normal boot.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/starkernel/x509_ed25519.h

@@ -61,4 +61,34 @@ int x509_extract_serial(const uint8_t *der, size_t der_len,
                          uint8_t *serial_out, size_t serial_out_cap,
                          size_t *serial_len_out);
 
+/*
+ * x509_build_user_cert (added 2026-08-28, FABRIC-3.md §F.8/§F.19, MINT):
+ * the encode-side counterpart to x509_verify_signature()/x509_extract_*
+ * above. Builds a minimal DER-encoded X.509 certificate exercising
+ * exactly the fields those functions read -- serialNumber, an Ed25519
+ * SubjectPublicKeyInfo, an Ed25519-signed signatureValue -- and nothing
+ * else. issuer/validity/subject are each encoded as an empty SEQUENCE
+ * (valid, zero-length DER TLVs the decode side only ever skips, never
+ * reads the content of); version is omitted entirely (implicit v1,
+ * matching the decode side's own optional-version handling). This is
+ * deliberately not a general-purpose X.509 builder -- same scope
+ * discipline as the decode side's own doc comment above.
+ *
+ * @param out            Caller-provided output buffer.
+ * @param out_cap        Its size in bytes.
+ * @param subject_pubkey The new identity's own Ed25519 public key --
+ *                       becomes the cert's SubjectPublicKeyInfo.
+ * @param serial         16 bytes -- becomes the cert's serialNumber
+ *                       (CERTVERIFY/BINDSTEP compare this against
+ *                       homeblocks_sig_t.drive_uuid).
+ * @param issuer_seed    The signer's own Ed25519 seed (Zuse's
+ *                       vm->zuse_cert_seed) -- signs the resulting
+ *                       tbsCertificate bytes.
+ * @return Number of bytes written to out, or 0 if out_cap was too small.
+ */
+size_t x509_build_user_cert(uint8_t *out, size_t out_cap,
+                             const uint8_t subject_pubkey[32],
+                             const uint8_t serial[16],
+                             const uint8_t issuer_seed[32]);
+
 #endif /* STARKERNEL_X509_ED25519_H */