FABRIC-3.md §I.3/§I.8: WIREBIND EJECT/detach + EXPIRE re-scoped as logout

Closes §I.3 (Milestone 5 remainder): WIREBIND now tracks which VM is
attached via the home-blocks USB path, and a new EJECT word plus the
existing hot-unplug signal both flush/reset-console/kill through it
(FABRIC-3.md §F.10).

Closes §I.8 (EXPIRE/ACL), re-scoped: the original "admit the zuse
session as a Stadium patron and reap on TTL" plan was invalidated a
second time -- Zuse authenticates directly onto Hera, who is patron
zero and permanently pinned, so there is no patron for a reap sweep to
ever find. Built instead as a detach-triggered logout
(capsule_zuse_boot_logout()), the same trigger EJECT/hot-unplug use for
regular WIREBIND users, so neither identity is a special case. Required
a companion fix: install_and_activate() used to skip re-running
ACL-ZUSE-BOOT whenever the cert was already installed, which made a
logout permanent for the rest of the boot; the outer re-attach gate now
checks zuse_session (clears on logout) instead of zuse_cert_installed
(a deliberate permanent one-way ratchet, left untouched).

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after both steps; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

src/starkernel/capsule/mama_forth_words.c

@@ -43,6 +43,7 @@
 #include "starkernel/capsule_runcap.h"
 #include "starkernel/capsule_console.h"
 #include "starkernel/capsule_wirebind.h"
+#include "starkernel/capsule_zuse_boot.h" /* capsule_zuse_boot_logout() -- FABRIC-3.md §I.8 EJECT */
 #include "starkernel/homeblocks_sig.h"
 #include "freestanding/stdio.h"
 #include "starkernel/capsule_mint.h"
@@ -580,6 +581,25 @@ void mama_word_kill(VM *vm)
     /* Stack clean on exit */
 }
 
+/**
+ * @brief EJECT ( -- )
+ * Graceful detach of whatever identity is currently attached via the
+ * home-blocks USB path (FABRIC-3.md §F.10, extended §I.8 2026-09-04) --
+ * a regular WIREBIND user VM or Zuse herself, no identity handled any
+ * differently. Single-USB-device constraint (§F.8) means there is only
+ * ever one candidate, so at most one of the two calls below actually
+ * does anything; the other is a no-op. capsule_wirebind_eject() flushes,
+ * resets the console's active VM if bound to it, then kills a user VM;
+ * capsule_zuse_boot_logout() clears zuse_session (no flush/kill -- Zuse
+ * owns no separate VM or blocks of her own).
+ */
+void mama_word_eject(VM *vm)
+{
+    capsule_wirebind_eject();
+    capsule_zuse_boot_logout(vm);
+    /* Stack clean on exit */
+}
+
 /**
  * @brief VM-STEP ( c-addr u -- )
  * Give one REPL quantum to a named VM.
@@ -1491,6 +1511,7 @@ void register_mama_forth_words(VM *vm)
     register_word(vm, "CONNECT-ARTEMIS", mama_word_connect_artemis);
     register_word(vm, "BIRTH", mama_word_birth);
     register_word(vm, "KILL", mama_word_kill);
+    register_word(vm, "EJECT", mama_word_eject);
     register_word(vm, "START", mama_word_start);
     register_word(vm, "STOP", mama_word_stop);
     register_word(vm, "USE", mama_word_use);
@@ -1527,6 +1548,7 @@ void register_mama_forth_words(VM *vm)
     register_word(vm, "CONNECT-ARTEMIS", mama_word_connect_artemis);
     register_word(vm, "BIRTH", mama_word_birth);
     register_word(vm, "KILL", mama_word_kill);
+    register_word(vm, "EJECT", mama_word_eject);
     register_word(vm, "START", mama_word_start);
     register_word(vm, "STOP", mama_word_stop);
     register_word(vm, "USE", mama_word_use);