starkernel: item 4.1a -- quota granting, Hermes's one-time birth grant

Punch list §25 item 4.1a complete.
New prerequisite item, found while scoping 4.2: no quota-granting mechanism
existed at all. Adds stadium_grant_quota(new_vm_id, from_vm_id) -- a
one-time initial grant at birth, distinct from item 1.3's still-unbuilt
recurring capacity-transfer arbitration. Splits the donor's free list evenly
by cell count, reassigns stadium_owner[] for every moved cell, and grants
the new VM a fresh Q48_ONE reservoir (not a split of the donor's -- per-VM
conservation, same pattern as Hera's own boot grant). Wired into every baby
VM's birth in capsule_birth.c.

Verified via a boot-time self-test in kernel_main.c using a synthetic
identity (not the real UUID pool, not a real capsule birth -- item 0.1's
Hera-alone pruning stays intact). All three architectures booted to ok> with
identical output: grant OK, Hera reservoir=0 (already fully committed to
resident words, correctly unchanged), test-vm reservoir=65536 (fresh
Q48_ONE). dict_hash identical across all three and unchanged from item 4.1's
baseline (0x3d4e1daf289da94f) -- confirms no dictionary word was added.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC.md

@@ -3300,7 +3300,7 @@ document and committing that amendment as its own item.*
   >   parity output — untouched, as designed. Stadium diagnostics also identical across all
   >   three: `promotions=354 evictions=0`, `resident_sum=65536 reservoir=0 sum=65536
   >   (Q48_ONE=65536)` — the conservation invariant closes exactly.
-- [ ] **4.1a — Quota granting: Hermes's birth grant.** New prerequisite item, inserted
+- [x] **4.1a — Quota granting: Hermes's birth grant.** New prerequisite item, inserted
   2026-08-05 while scoping 4.2 — found that no quota-granting mechanism exists at all.
   `quota_slot_for_vm()` refuses every `vm_id != 0` today, permanently, by design (item 3.5's
   note); `stadium_admit()`'s own doc and item 3.2's DONE note both defer per-VM free lists to
@@ -3323,23 +3323,30 @@ document and committing that amendment as its own item.*
   >    even split needs no threshold, consistent with §22's "no tuned threshold" elsewhere in
   >    this design.
   >
-  > *Done when:*
-  > - A new `stadium_grant_quota(VMUuid vm_id)` (or equivalent, named at implementation
-  >   time) exists in `stadium.c`, callable at a baby VM's birth (`capsule_birth.c`).
-  > - Splits Hera's free list evenly by cell count (±1 for odd counts), reassigns
-  >   `stadium_owner[idx]` for every cell that moves, and grants the new VM a fresh
-  >   `Q48_ONE` reservoir — verified by both VMs' independent conservation checks closing
-  >   exactly immediately after the grant, with zero residents on either side yet.
-  > - Hera's own residents (including cell 0) are provably untouched — same cell count and
-  >   identities before and after the grant.
-  > - Refuses (does not crash) if `vm_id` already holds a quota, or if the granting VM's
-  >   free list is empty.
-  > - All three architectures boot to `ok>` with logs under `logs/`, `dict_hash` unchanged
-  >   from item 4.1's baseline (`0x3d4e1daf289da94f`) since this item touches no dictionary
-  >   word.
+  > *Done, verified 2026-08-05.* `stadium_grant_quota(VMUuid new_vm_id, VMUuid from_vm_id)`
+  > (`stadium.c`/`stadium.h`) exists as designed: counts `from_vm_id`'s free list, splits the
+  > first half (by list-walk order) into a new quota slot for `new_vm_id` with `stadium_owner`
+  > reassigned per moved cell, terminates both lists correctly, and grants a fresh `Q48_ONE`
+  > reservoir. Refuses without crashing if `new_vm_id` already holds a quota, `from_vm_id`
+  > holds none, the free list has fewer than 2 cells, or no empty quota slot remains. Wired
+  > into every baby VM's birth (`capsule_birth.c`, right after `stadium_vm_id` is set, before
+  > IDENTITY exec) — failure is non-fatal to birth itself, same as having no quota is today's
+  > status quo for every VM.
+  >
+  > *Verified* via a boot-time self-test (`kernel_main.c`, right after item 4.1's diagnostic
+  > print) using a synthetic identity — deliberately not `vm_uuid_next()`'s real birth pool
+  > (would perturb the deterministic ID stream) and not a real capsule birth (item 0.1 pruned
+  > automatic Hermes birth from `init.4th`; restoring that is item 4.2's job, not this one's).
+  > All three architectures booted to `ok>` with logs under `logs/20260805-145714/amd64/`,
+  > `logs/20260805-145806/aarch64/`, `logs/20260805-145902/riscv64/`, each printing identically:
+  > `Stadium quota grant self-test: OK`, `Hera reservoir=0` (already fully committed to
+  > resident words by item 4.1's own self-test, unchanged by this grant — correct, since this
+  > item never touches reservoir on the donor side), `test-vm reservoir=65536` (a fresh
+  > `Q48_ONE`, as ruled). `dict_hash` identical across all three and unchanged from item 4.1's
+  > baseline (`0x3d4e1daf289da94f`), confirming this item added no dictionary word.
 - [ ] **4.2 — Hermes native on the Stadium.** The proving ground; produces the effort
-  number. *Refs:* §10. **Blocked on 4.1a** — Hermes cannot hold Stadium residents without a
-  quota, and nothing grants one yet.
+  number. *Refs:* §10. **Unblocked 2026-08-05** — item 4.1a closed; `stadium_grant_quota()`
+  exists and is wired into every baby VM's birth.
 
   > **Two rulings taken before work starts, 2026-08-05:**
   > 1. **`stadium_owner[idx]` fix folded into this item's scope**, by explicit Captain Bob