Cursor indicator + HB-ON/HB-OFF runtime DoE instrumentation toggle

Cursor (Captain Bob: "the only thing we need is a cursor"):
vt100_draw_cursor() draws a solid block at the terminal's current
position, called from repl.c after the prompt prints and after every
keystroke/backspace. vt100_erase_cursor() cleans up the one gap a static
cursor has -- Enter/newline moves away from the cursor cell without a
character draw ever overwriting it, which left a stray block behind
until this fix.

HB-ON/HB-OFF (Captain Bob: run a program with or without instrumentation
without rebuilding):
Converted per-tick DoE logging from a build-time flag (HEARTBEAT_DOE_LOG)
to a runtime one. doe_log_tick_row() now self-gates on g_doe_log_enabled
(default 1, matching the old default) instead of being compiled out
entirely; the call site in vm_runtime.c is unconditional. Two new FORTH
words, HB-ON and HB-OFF, flip the flag live. Removed the now-dead
HEARTBEAT_DOE_LOG plumbing: the Kconfig symbol, and the -D forwarding in
both LOADER_CFLAGS and KERNEL_CFLAGS.

Verified: three-arch clean QEMU boot + logs; dictionary word count 466
(463 baseline + ALT+TAB + HB-ON + HB-OFF, exactly the three words added
across this session); amd64 screendump confirms the cursor renders
correctly after real interactive typing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/starkernel/console.h

@@ -98,6 +98,20 @@ void console_fb_scroll_fwd(uint32_t n);
  */
 void console_fb_toggle_graphics(void);
 
+/**
+ * Thin wrapper over vt100_draw_cursor() -- see that function's doc
+ * comment for the full contract (a static block cursor at the terminal's
+ * current position). No-op if the framebuffer console was never
+ * initialized.
+ */
+void console_fb_draw_cursor(void);
+
+/**
+ * Thin wrapper over vt100_erase_cursor(). No-op if the framebuffer
+ * console was never initialized.
+ */
+void console_fb_erase_cursor(void);
+
 /**
  * Write a single character to serial console
  */

include/starkernel/doe_log.h

@@ -19,8 +19,11 @@
  *
  * A header row is printed automatically before the first data row.
  *
- * Compiled in when HEARTBEAT_DOE_LOG=1 (default in KERNEL_CFLAGS).
- * Call sites in vm_runtime.c are gated with the same macro.
+ * Always compiled in -- gating moved from a build-time flag
+ * (HEARTBEAT_DOE_LOG) to a runtime one (g_doe_log_enabled below) so the
+ * same build can run with or without per-tick instrumentation, toggled
+ * live via the HB-ON/HB-OFF FORTH words (register_doe_log_words()),
+ * no rebuild required.
  */
 
 #ifndef STARKERNEL_DOE_LOG_H
@@ -29,13 +32,30 @@
 #include "vm.h"
 
 /**
- * Emit one CSV row for the current heartbeat tick.
- * Pulls APIC TimeTrustState via heartbeat_state().
- * Prints the column header automatically on the first call.
+ * Runtime enable flag for doe_log_tick_row() below. Defaults to 1
+ * (matches the old HEARTBEAT_DOE_LOG=1 default -- instrumentation on
+ * unless explicitly turned off). Toggled by HB-ON/HB-OFF; read, not
+ * meant to be written directly outside those two words.
+ */
+extern int g_doe_log_enabled;
+
+/**
+ * Emit one CSV row for the current heartbeat tick, unless
+ * g_doe_log_enabled is 0 (a no-op then). Pulls APIC TimeTrustState via
+ * heartbeat_state(). Prints the column header once, before the first row
+ * ever emitted -- not re-printed on every HB-ON, so a session toggled
+ * off and back on stays one continuous CSV rather than getting a second
+ * header embedded partway through.
  *
  * @param vm      VM instance (used for snapshot data)
  * @param snap    Populated HeartbeatTickSnapshot from heartbeat_capture_tick_snapshot()
  */
 void doe_log_tick_row(VM *vm, const HeartbeatTickSnapshot *snap);
 
+/**
+ * Registers HB-ON ( -- ) and HB-OFF ( -- ), which set g_doe_log_enabled
+ * to 1 and 0 respectively.
+ */
+void register_doe_log_words(VM *vm);
+
 #endif /* STARKERNEL_DOE_LOG_H */

include/starkernel/vt100.h

@@ -110,6 +110,22 @@ void vt100_puts(const char *s);
  */
 void vt100_toggle_graphics(void);
 
+/**
+ * Draw a solid block cursor at the terminal's current position. Static,
+ * not blinking. Idempotent -- safe to call after every keystroke, since
+ * whatever gets typed next naturally overwrites it. No-op before TTF mode
+ * is active or while in graphics mode (vt100_toggle_graphics()).
+ */
+void vt100_draw_cursor(void);
+
+/**
+ * Erases whatever vt100_draw_cursor() last drew, restoring the cell to
+ * plain background. Call before moving away from a cursor-drawn cell
+ * without also drawing a character there (e.g. Enter/newline). No-op
+ * before TTF mode is active or while in graphics mode.
+ */
+void vt100_erase_cursor(void);
+
 /* -----------------------------------------------------------------------
  * Queries
  * --------------------------------------------------------------------- */