FABRIC-3.md §I.3/§I.8: WIREBIND EJECT/detach + EXPIRE re-scoped as logout

Closes §I.3 (Milestone 5 remainder): WIREBIND now tracks which VM is
attached via the home-blocks USB path, and a new EJECT word plus the
existing hot-unplug signal both flush/reset-console/kill through it
(FABRIC-3.md §F.10).

Closes §I.8 (EXPIRE/ACL), re-scoped: the original "admit the zuse
session as a Stadium patron and reap on TTL" plan was invalidated a
second time -- Zuse authenticates directly onto Hera, who is patron
zero and permanently pinned, so there is no patron for a reap sweep to
ever find. Built instead as a detach-triggered logout
(capsule_zuse_boot_logout()), the same trigger EJECT/hot-unplug use for
regular WIREBIND users, so neither identity is a special case. Required
a companion fix: install_and_activate() used to skip re-running
ACL-ZUSE-BOOT whenever the cert was already installed, which made a
logout permanent for the rest of the boot; the outer re-attach gate now
checks zuse_session (clears on logout) instead of zuse_cert_installed
(a deliberate permanent one-way ratchet, left untouched).

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after both steps; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

src/starkernel/repl.c

@@ -265,6 +265,17 @@ static void sk_repl_idle(VM *active_vm)
         if (g_attached_blk_dev == &usb_blk_dev) {
             g_attached_blk_dev = (void *)0;
         }
+
+        /* FABRIC-3.md §F.10 decision 2 (UNCLEAN, closed alongside EJECT):
+         * the device is already gone -- no-op if WIREBIND never had
+         * anything tracked (general-purpose USB use, not a home-blocks
+         * identity drive). */
+        capsule_wirebind_unclean_detach();
+
+        /* FABRIC-3.md §I.8, re-scoped 2026-09-04: Zuse logs out on device
+         * removal exactly like a WIREBIND user -- no-op if the device
+         * that just left wasn't hers. */
+        capsule_zuse_boot_logout((VM *)sk_get_mama_vm());
     }
 
     /* FABRIC.md/FABRIC-2.md Section V item 6: "a cheap 'anything dirty?