Cursor indicator + HB-ON/HB-OFF runtime DoE instrumentation toggle

Cursor (Captain Bob: "the only thing we need is a cursor"):
vt100_draw_cursor() draws a solid block at the terminal's current
position, called from repl.c after the prompt prints and after every
keystroke/backspace. vt100_erase_cursor() cleans up the one gap a static
cursor has -- Enter/newline moves away from the cursor cell without a
character draw ever overwriting it, which left a stray block behind
until this fix.

HB-ON/HB-OFF (Captain Bob: run a program with or without instrumentation
without rebuilding):
Converted per-tick DoE logging from a build-time flag (HEARTBEAT_DOE_LOG)
to a runtime one. doe_log_tick_row() now self-gates on g_doe_log_enabled
(default 1, matching the old default) instead of being compiled out
entirely; the call site in vm_runtime.c is unconditional. Two new FORTH
words, HB-ON and HB-OFF, flip the flag live. Removed the now-dead
HEARTBEAT_DOE_LOG plumbing: the Kconfig symbol, and the -D forwarding in
both LOADER_CFLAGS and KERNEL_CFLAGS.

Verified: three-arch clean QEMU boot + logs; dictionary word count 466
(463 baseline + ALT+TAB + HB-ON + HB-OFF, exactly the three words added
across this session); amd64 screendump confirms the cursor renders
correctly after real interactive typing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/hal/console.c

@@ -324,6 +324,20 @@ void console_fb_toggle_graphics(void)
     }
 }
 
+void console_fb_draw_cursor(void)
+{
+    if (fb_is_available()) {
+        vt100_draw_cursor();
+    }
+}
+
+void console_fb_erase_cursor(void)
+{
+    if (fb_is_available()) {
+        vt100_erase_cursor();
+    }
+}
+
 /**
  * Read a single character from serial console (non-blocking)
  * Returns -1 if no character available

src/starkernel/hal/vt100.c

@@ -313,6 +313,33 @@ static void draw_cursor_glyph(uint8_t ch)
     }
 }
 
+/* Solid block cursor at the current position (g_vt.cx, g_vt.cy). Not
+ * blinking -- a static indicator, simplest thing that actually shows
+ * where typed input lands, callable as often as the caller likes since
+ * it is idempotent (always draws the same thing at the current position).
+ * A character typed at this position naturally overwrites it --
+ * draw_cursor_glyph() always fills the whole cell with bg before drawing
+ * a glyph -- but *leaving* this position without drawing a character
+ * (Enter/newline) does not, which is what vt100_erase_cursor() below is
+ * for. No-op outside TTF mode or graphics mode (4.4ab's
+ * g_terminal_visible), matching every other draw call in this file. */
+void vt100_draw_cursor(void)
+{
+    if (!g_terminal_visible || g_glyph_mode != VT_GLYPH_TTF) return;
+    fb_fill_rect(px_of(g_vt.cx), py_of(g_vt.cy), cell_w(), cell_h(), eff_fg());
+}
+
+/* Erases whatever vt100_draw_cursor() last drew at the current position,
+ * restoring it to plain background -- call this before moving away from
+ * a cursor-drawn cell without also drawing a character there (the
+ * newline case in sk_readline: Enter moves to a new line, and nothing
+ * else would ever overwrite the stray block left behind). */
+void vt100_erase_cursor(void)
+{
+    if (!g_terminal_visible || g_glyph_mode != VT_GLYPH_TTF) return;
+    fb_fill_rect(px_of(g_vt.cx), py_of(g_vt.cy), cell_w(), cell_h(), eff_bg());
+}
+
 static void reset_attrs(void)
 {
     g_vt.fg        = g_vt.def_fg;