proof/: migrate cell from int to 64-bit signed word, full suite verifies

cell_t is a 64-bit signed C long; the formal model previously used
unbounded HOL int, hiding wraparound and signed/unsigned distinctions
entirely. Switches cell to "64 word" throughout and fixes every proof
site that assumed int semantics:

- StarForth_Base.thy: cell_safe/cell_abs/cell_sdiv/cell_smod plus the
  sint-bridging lemmas used across the suite
- StarForth_Loop1_Heat.thy, StarForth_Loop3_Decay.thy: heat tracking
  converted to signed word comparisons (<s/\<le>s)
- StarForth_Stack_Words.thy: PICK/ROLL against real C ground truth
- StarForth_Arithmetic_Words.thy: ABS/MIN/MAX/div/mod rebuilt on signed
  word semantics (cell_sdiv/cell_smod match C99 truncating division;
  2/ uses signed_drop_bit to match "n >> 1"); documents a genuine
  ABS(INT64_MIN) wraparound hazard mirroring the real C behavior
- StarForth_Memory_Words.thy: @/!/C@/C! address checks converted to
  the signed order

All 23 theory files verify with zero errors, including
StarForth_Concurrent and StarForth_Correctness.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/StarForth_Loop3_Decay.thy

@@ -144,10 +144,16 @@ lemma vm_decay_step_dict [simp]:
    Section 5: Total heat — fully proved monotonicity
    ======================================================================== *)
 
+(* CORRECTED for the cell-as-word migration: sums sint (de_heat ...), not
+   de_heat directly. de_heat is now a bounded 64-bit word per entry, but
+   the AGGREGATE across an unbounded number of dictionary entries should
+   not itself be silently truncated to 64 bits -- summing the signed int
+   value of each entry keeps total_dict_heat genuinely unbounded, as
+   intended. *)
 definition total_dict_heat :: "vm_state \<Rightarrow> int" where
   "total_dict_heat vm =
      (\<Sum>i \<in> {i. dictionary vm i \<noteq> None}.
-       de_heat (the (dictionary vm i)))"
+       sint (de_heat (the (dictionary vm i))))"
 
 (* PROOF (no sorry):
    vm_decay_step only changes decay_slope_q48, so dictionary is identical
@@ -159,7 +165,7 @@ lemma decay_step_dict_unchanged:
   by simp   \<comment> \<open>vm_decay_step_dict [simp] rewrites the dictionary field\<close>
 
 lemma decay_total_heat_non_increasing:
-  assumes "\<forall>i. dictionary vm i \<noteq> None \<longrightarrow> de_heat (the (dictionary vm i)) \<ge> 0"
+  assumes "\<forall>i. dictionary vm i \<noteq> None \<longrightarrow> 0 \<le>s de_heat (the (dictionary vm i))"
   shows "total_dict_heat (vm_decay_step step vm) \<le> total_dict_heat vm"
   by (simp add: decay_step_dict_unchanged)