Stage 3 follow-on: message-arrival eligibility hook + trampoline-blind switch-storm fix (FABRIC-3.md §XXVIII.2)

Implements the message-arrival eligibility signal FABRIC-3.md §XXVIII.1 left
open (has_work per-slot flag, set via new SWITCH-MARK-WORK primitive from
MSG-SEND) so an idle VM never becomes a switch target purely by waiting out
the readiness threshold.

Also root-causes and fixes a second, independent switch-storm: the tick's
"who is current" check used vm_log_attributed_vm(), which can't see a VM
parked in switch.c's own raw trampoline. Replaced with a dedicated
g_switch_current_vm tracked by the switch mechanism itself, and moved
target-slot eligibility reset to the switch decision point instead of
relying on ISR polling to observe a window that can be only a few
instructions wide.

Verified live on all 3 architectures: clean boot to zuse@Hera] ok>, live
cross-VM message dispatch, and (since a quiet log looks identical to a
livelocked storm once the DoE probe is gone) confirmed genuine REPL
liveness via QMP send-key + screendump on aarch64/riscv64, not log
inspection alone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

capsules/common/messaging.4th

@@ -226,6 +226,7 @@ Block 5019
 Block 5020
 ( deliver )
 VARIABLE MSG-LAST-MSG
+VARIABLE MSG-SEND-TO-IDX
 : IDX>NAME ( idx -- addr u )
   DUP VM-MAX >= IF DROP 0 0 EXIT THEN
   DUP CELLS VM-NAME-ADDRS + @
@@ -239,13 +240,15 @@ Block 5021
 ( (zero-heat would lose eviction-fallback density )
 ( comparisons), not set afterward as before. )
 : MSG-SEND ( type from to paddr plen ch -- )
+  3 PICK MSG-SEND-TO-IDX !
   Q.SLOT MSG-ALLOC DUP 0= IF 2DROP 2DROP 2DROP DROP EXIT THEN
   >R
   MSG-SEQ @ 1+ DUP MSG-SEQ ! R@ MSG-SEQ!
   R@ MSG-CH!
   R@ MSG-PLEN! R@ MSG-PADDR!
   R@ MSG-TO!   R@ MSG-FROM! DUP R@ MSG-TYPE! R@ MSG-ORIG-TYPE!
-  R> DROP ;
+  R> DROP
+  MSG-SEND-TO-IDX @ IDX>NAME SWITCH-MARK-WORK ;
 Block 5022
 ( MSG-COOL-ONE/ALL: linear decay per tick )
 VARIABLE MSG-SCAN