Stadium: real VM-patron admission + real COOL dispatch at KILL (FABRIC-3.md §B)

capsule_vm_kill() had zero Stadium involvement (vm_cleanup()/sf_free()
only), and child-VM birth only ever called stadium_grant_quota() -- a
resource pool for the VM's own future word/block patrons, never
stadium_admit() for the VM itself. stadium_birth_hera() looked like a
precedent but admits Hera into her own quota as a permanently pinned
cell 0, which can never reach stadium_evict() -- not a working example
of COOL firing for a VM.

Adds size_t stadium_patron_cell to VMRegistryEntry. At birth, right
after the existing stadium_grant_quota() call, admits a candidate into
the new VM's own quota mirroring stadium_birth_hera()'s shape
(identity=0, mass=1, behaviour=COOL) but deliberately unpinned --
pinning would need a new "unpin" primitive (none exists) to ever evict
it later, and unpinned costs nothing since nothing wires COOL's
dispatch body to kill anything; the worst case of an unrelated natural
eviction is stale bookkeeping, tolerated the same way
stadium_word_forget() already tolerates staleness elsewhere. At
capsule_vm_kill() and capsule_vm_kill_all_nonmama(): stadium_evict()
the tracked cell if still resident, silently tolerating refusal
(already gone). stadium_dispatch()'s COOL case needed no new payload
body -- same as it already is for words, where COOL has no defined
extra action beyond stadium_evict()'s own universal reservoir credit.

On investigation this turned out not to be entangled with the
still-iterating Tripod/Zuse/messaging vision after all -- birth and
kill already funnel through two single choke points, so the earlier
deferral (previous commit) was overcautious.

Verified live: a second, new "Stadium: dispatch cell=... behaviour=
COOL" now fires immediately before every PARITY:KILL line, for both
Hermes and Artemis, distinct from the pre-existing COMMON-CH
word-eviction self-test's own COOL print. Conservation
(resident_sum + reservoir == Q48_ONE) intact throughout. Clean
zero-warning compile and clean boot on all three architectures.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

src/starkernel/capsule/capsule_birth.c

@@ -124,6 +124,10 @@ void capsule_vm_registry_init(void *mama_vm_ptr) {
     mama->entry.flags              = 0;
     mama->entry.parent_vm_id       = vm_uuid_hera();  /* self-referential: Hera is the root */
     mama->entry.vm_ptr             = mama_vm_ptr;
+    mama->entry.stadium_patron_cell = STADIUM_CELL_NONE; /* set for real by
+                                                           * stadium_birth_hera()
+                                                           * separately -- not
+                                                           * tracked here */
     for (i = 0; i < VM_NAME_MAX; i++) mama->entry.name[i] = '\0';
     vm_name_copy(mama->entry.name, "Hera");
     mama->next = (void *)0;
@@ -158,6 +162,7 @@ static VMRegistryEntry *vm_registry_alloc(void) {
                                           * today; see design doc's "explicitly
                                           * out of scope" for making this dynamic */
     node->entry.vm_ptr             = (void *)0;
+    node->entry.stadium_patron_cell = STADIUM_CELL_NONE;
     for (i = 0; i < VM_NAME_MAX; i++) node->entry.name[i] = '\0';
     node->next = (void *)0;
 
@@ -325,6 +330,15 @@ int capsule_vm_kill(const char *name) {
     vm_id = entry->vm_id;
     vm    = (VM *)entry->vm_ptr;
 
+    /* FABRIC-3.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
+     * real, dispatching COOL. Refusal (already naturally reclaimed by
+     * unrelated quota pressure, or never admitted) is silently tolerated --
+     * KILL tears the VM down unconditionally either way. */
+    if (entry->stadium_patron_cell != STADIUM_CELL_NONE) {
+        (void)stadium_evict(entry->stadium_patron_cell);
+        entry->stadium_patron_cell = STADIUM_CELL_NONE;
+    }
+
     /* Tear down and free */
     if (vm) {
         vm_cleanup(vm);
@@ -357,6 +371,10 @@ void capsule_vm_kill_all_nonmama(void) {
         }
         vm_id = node->entry.vm_id;
         vm    = (VM *)node->entry.vm_ptr;
+        if (node->entry.stadium_patron_cell != STADIUM_CELL_NONE) {
+            (void)stadium_evict(node->entry.stadium_patron_cell);
+            node->entry.stadium_patron_cell = STADIUM_CELL_NONE;
+        }
         if (vm) {
             vm->halted = 1;
             vm_cleanup(vm);
@@ -493,6 +511,38 @@ CapsuleRunResult capsule_birth_baby(
      * stillbirth here is the rare case, not the common one. */
     (void)stadium_grant_quota(vm_id, vm_uuid_hera());
 
+    /* FABRIC-3.md SS B, VM-COOL: admit this VM as a patron of its own
+     * quota -- identity 0 (same convention stadium_birth_hera() uses for
+     * "patron zero"), heat 0 (no reservoir cost), unpinned (unlike Hera --
+     * there is no unpin primitive, and pinning here would make the
+     * explicit KILL-time eviction below unreachable without adding one).
+     * Unpinned means unrelated quota pressure on this VM's own words/
+     * blocks could naturally evict this cell before KILL ever runs; that
+     * is tolerated, not a bug -- nothing wires COOL's dispatch body to
+     * kill anything, so the only visible effect is entry->stadium_
+     * patron_cell going stale, which the KILL-time eviction below already
+     * tolerates (stadium_evict() simply refuses if it's already gone).
+     * Soft failure, same as stadium_grant_quota() above -- a refused
+     * admission leaves stadium_patron_cell at STADIUM_CELL_NONE, and
+     * nothing downstream depends on it succeeding. */
+    {
+        StadiumPatronHeader vm_patron;
+        uint8_t            *raw = (uint8_t *)&vm_patron;
+        size_t               i;
+
+        for (i = 0; i < sizeof(vm_patron); i++) raw[i] = 0;
+        vm_patron.identity  = 0;
+        vm_patron.heat      = 0;
+        vm_patron.ttl       = 0;
+        vm_patron.link      = 0;
+        vm_patron.contains  = STADIUM_CONTAINS_NONE;
+        vm_patron.mass      = 1;
+        vm_patron.flags     = 0;
+        vm_patron.behaviour = (uint8_t)STADIUM_BEHAVIOUR_COOL;
+
+        entry->stadium_patron_cell = stadium_admit(vm_id, &vm_patron);
+    }
+
     const uint8_t *payload = capsule_get_payload(cap, arena);
     if (!payload) {
         entry->state = VM_STATE_STILLBORN;