WIREBIND cert verification: load Zuse's root pubkey independently of her live session

Root cause of the remaining "identity attach doesn't complete when Zuse
never attaches this boot" issue: capsule_wirebind_verify_cert() gated on
mama_vm->zuse_cert_installed, which is only ever set when Zuse's own
drive attaches and authenticates this specific boot
(capsule_zuse_boot_try_attach() -> install_and_activate() ->
vm_zuse_cert_install()). Without her, any other identity's WIREBIND cert
verification silently refused -- correctly, by the old design, but that
design conflated two genuinely different things: "can mint new
identities" (needs Zuse's live private seed, a real privileged
operation) and "can verify an existing identity's cert" (needs nothing
but her already-public key).

That public key was already being persisted independently of her live
session: zuse_genesis_marker_t (zuse_genesis_marker.h) stores it in the
kernel's own top-of-device metadata fence (Artemis's resident storage),
written once at genesis, specifically *not* alongside her private seed
(which stays only on her own removable thumbdrive) -- the type's own doc
comment says as much. It just wasn't being loaded for anything but
confirming which drive is genuinely hers.

Fix: a new capsule_zuse_boot_load_root_pubkey() (capsule_zuse_boot.c)
reads that marker and populates two new VM fields, zuse_root_pubkey_known
/ zuse_root_pubkey (vm.h) -- deliberately separate from
zuse_cert_installed/zuse_cert_seed/zuse_cert_pubkey, which stay
untouched and still gate MINT exactly as before. Called once from
kernel_main.c as soon as Artemis's own storage attaches, unconditionally,
independent of whether Zuse's own drive is ever attached this boot.
capsule_wirebind_verify_cert()/capsule_wirebind_try_attach() now check
zuse_root_pubkey_known instead of zuse_cert_installed.

One identity's attach must not depend on another identity's live
presence -- each identity stands on its own once the fleet's root of
trust has been established once, ever.

Verified live, amd64: identity 00 (disk/thumbdrives/00-thumb-ident.img)
now attaches and completes WIREBIND in 19 seconds with Zuse's own drive
never attached this boot at all (previously: unbounded, many real
minutes or effectively never, before today's other fixes; still slow/
stuck after those, stuck specifically on this silent refusal). Zuse's
own attach flow re-verified unaffected (regression check, amd64).
Three-arch clean qemu acceptance (amd64/aarch64/riscv64) passed with
this change included.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Ec88YKxxhZGG1RNnune78

include/starkernel/capsule_zuse_boot.h

@@ -98,6 +98,31 @@ void capsule_zuse_boot_logout(VM *mama_vm, struct blkio_dev *dev);
  */
 struct blkio_dev *capsule_zuse_boot_attached_dev(void);
 
+/**
+ * capsule_zuse_boot_load_root_pubkey - Populate mama_vm->zuse_root_pubkey/
+ * zuse_root_pubkey_known from the persistent genesis-marker fence
+ * (zuse_genesis_marker_t, block_subsystem.h's blk_meta_zone_read()),
+ * independently of whether Zuse's own thumbdrive is attached this boot.
+ *
+ * Call once, early -- as soon as the block subsystem and Artemis's own
+ * resident storage are up (the fence lives there, not on any removable
+ * drive) -- from kernel_main.c. No-op (leaves zuse_root_pubkey_known 0)
+ * if no genesis has ever happened yet (no marker in the fence): there is
+ * no root identity to verify against, so no WIREBIND identity could have
+ * a cert chained to one either.
+ *
+ * Deliberately does not touch zuse_cert_installed/zuse_cert_seed/
+ * zuse_cert_pubkey -- that triple stays reserved for Zuse's own live,
+ * authenticated session (capsule_zuse_boot_try_attach()), gating MINT
+ * (needs her private seed). This function only ever loads her already-
+ * public key, for WIREBIND cert *verification* (capsule_wirebind.c),
+ * which needs nothing else -- see zuse_root_pubkey_known's own doc
+ * comment (vm.h) for the full reasoning.
+ *
+ * @param mama_vm Hera's own VM (zuse_root_pubkey/_known live here).
+ */
+void capsule_zuse_boot_load_root_pubkey(VM *mama_vm);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_CAPSULE_ZUSE_BOOT_H */

include/vm.h

@@ -485,6 +485,21 @@ typedef struct VM
                                  *   redefinition-only guarantee can't be bypassed via >BODY on a
                                  *   CONSTANT (see FABRIC-2.md). Read-only FORTH access via
                                  *   ZUSE-PUBKEY@. */
+    uint8_t zuse_root_pubkey_known; /**< 1 = zuse_root_pubkey holds a real value, loaded from the
+                                 *   persistent genesis-marker fence (zuse_genesis_marker_t,
+                                 *   capsule_zuse_boot_load_root_pubkey()) independently of whether
+                                 *   Zuse's own thumbdrive is attached this boot. Deliberately
+                                 *   separate from zuse_cert_installed/zuse_cert_seed above -- that
+                                 *   pair is a one-way fuse gating MINT (needs her live private
+                                 *   seed); this pair gates WIREBIND cert *verification* only (needs
+                                 *   nothing but her already-public key), so a WIREBIND identity can
+                                 *   be verified and attach without requiring Zuse's own live session
+                                 *   this boot. Bob, 2026-09-09: "zuse is zuse, [each identity] is
+                                 *   [itself]" -- one identity's attach must not depend on another's
+                                 *   live presence. */
+    uint8_t zuse_root_pubkey[32]; /**< Ed25519 public key, loaded from the genesis-marker fence.
+                                 *   Same value zuse_cert_pubkey ends up holding once Zuse herself
+                                 *   attaches -- this is just available earlier and unconditionally. */
     /** @} */
 
     /** @name Dictionary Management