Extend BIRTH/CAPSULE-BIRTH to all VMs symmetrically; flag a real std79 lockdown gap (FABRIC-3.md §XXV)

Scoping the workload-into-factorial design's placement-mode factor
led to a real architectural improvement: rather than EXEC-ing a
workload capsule into an already-running, ACL-locked identity's own
persistent dictionary (filesystem-shaped, doesn't dodge the block-
collision exposure just traced in §XXIV), a workload now runs as a
fresh ephemeral child VM, BIRTH'd per trial and reaped after --
matching the project's own stated principle of automanagement over
imposed policy. CAPSULE-BIRTH already passes vm->stadium_vm_id (who
is birthing this VM) as the new child's parent, not a hardcoded Hera
constant, confirmed by reading the C -- so a workload trial genuinely
inherits the specific identity's own lineage when that identity does
the birthing.

Which surfaced a real premise: only Hera could call BIRTH/
CAPSULE-BIRTH at all (registered only in register_mama_forth_words(),
confirmed directly, not part of the earlier §XX messaging-symmetry
fix which deliberately kept this as one of her remaining privileges).
Extended symmetrically now, agreed explicitly before touching code:

- mama_forth_words.c: BIRTH and CAPSULE-BIRTH added to
  register_child_vm_words(), matching §XX's own pattern.
- acl-std79.4th: ' BIRTH , ' CAPSULE-BIRTH , added to ACL-STD79-LIST
  (new block 4048) -- a deliberate, explicit, named exception to the
  lockdown's own "standard words only" guarantee, not a silent one.
  Symmetric registration alone can't weaken any lockdown on its own:
  ACL-LOCKDOWN-STD79 is allowlist-based, deny-by-default, so a newly
  registered word is auto-denied there unless explicitly added.

Verified: clean build on all 3 architectures, zero new warnings.
Hera's own dict_hash unchanged (expected); Hermes/Artemis show the
same new dict_hash on all 3 architectures. Live-tested against a
real attached std79-locked identity: CAPSULE-BIRTH executes
correctly (returns vm_uuid_none() for a deliberately out-of-range
capsule-id, zero fault, zero ACL denial).

Found, and explicitly stopped short of fixing, a separate pre-
existing gap while verifying the above: MSG-STATUS and MSG-K
(messaging.4th words, not on the std79 allowlist) execute for a
locked identity instead of being denied. ACL-LOCKDOWN-STD79 is
confirmed to actually run; something more specific isn't reaching
messaging.4th's dictionary entries. Root cause not traced -- needs
its own investigation into vm_core.c's dictionary-link mechanics and
whichever capsule actually loads messaging for these identities.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo

capsules/acl-std79.4th

@@ -4,7 +4,9 @@ Block 4023
 ( Excludes: BYE, COLD/WARM/REBOOT/SAVE-SYSTEM, the block   )
 ( editor (L S SHOW EDIT UPDATE SAVE-BUFFERS), BLK-ACL-*,   )
 ( FORGET/FENCE. Kept: (BRANCH) etc -- IF/DO/LOOP compile   )
-( calls to these; denying them breaks control flow.        )
+( calls to these; denying them breaks control flow. One    )
+( deliberate non-standard exception: BIRTH/CAPSULE-BIRTH,  )
+( block 4048 -- FABRIC-3.md SXXV, 2026-09-12.              )
 ( Full rationale: FABRIC-3.md, 2026-09-07. )
 CREATE ACL-STD79-LIST
 
@@ -129,6 +131,13 @@ Block 4043
 ' EXIT , ' CASE , ' OF , ' ENDOF ,
 ' ENDCASE ,
 
+Block 4048
+( Deliberate non-standard exception, not part of  )
+( FORTH-79/83 -- lets a std79-locked identity own  )
+( BIRTH an ephemeral workload-trial child VM under )
+( its own lineage. FABRIC-3.md SXXV, 2026-09-12.   )
+' BIRTH , ' CAPSULE-BIRTH ,
+
 Block 4044
 ( ACL-STD79-ALLOWED? ( xt -- flag ) )
 : ACL-STD79-ALLOWED? ( xt -- flag )