WIREBIND: real thumbdrive-attach call site, no manual steps

Assembles pieces already built and individually verified this session
-- CERTVERIFY (vm_identity_from_cert(), Phase A/B), RUNCAP, the
console-VM + user-VM pair (§F.22) -- into one automatic sequence,
replacing the RUNCAP-TEST/PAIR-TEST diagnostic words that exercised
each piece by hand.

New capsule_wirebind_try_attach() (capsule_wirebind.h/.c), called from
sk_repl_idle() alongside capsule_zuse_boot_try_attach() on every
HOMEBLOCKS_SIG_OK attach: sig->cert_offset==0 means this is Zuse's own
genesis-mode drive (no cert region) -- that's already
capsule_zuse_boot_try_attach()'s job, skip. Otherwise, with Zuse already
authenticated this boot (nothing to verify a regular cert against
otherwise), reads the cert devblock(s) and calls vm_identity_from_cert()
against mama_vm's own zuse_cert_pubkey and the drive's own drive_uuid.
On success: reads the drive's own user_identity_seed_t for its
username, births a console VM + RUNCAP-born user VM pair (idempotent --
no-ops if that username is already live this session), installs the
verified VMIdentity onto the user VM, and registers the "<username>~user"
pairing sk_repl_dispatch_line() (repl.c, §F.22) looks for. Deliberately
does NOT auto-USE the new console -- that stays an explicit,
ACL-gated step (BINDSTEP, §F.9), not something a bare attach should
trigger silently.

Verified end-to-end live in QEMU, including a genuine negative case:
attached disk/user1.img (signed by a different, earlier-session Zuse
instance) and got a correct "cert verification FAILED -- drive
refused" -- proof the check is real, not a rubber stamp. Minted a
fresh identity with this boot's own Zuse, reattached, and got
"WIREBIND: SamS attached and ready" printed with zero manual commands,
followed by a working USE + async WELCOME relay end to end (queued,
no UNKNOWN WORD, delivered and executed in the paired user VM on the
next idle tick). Clean 3-architecture regression: Hermes/Artemis both
birth live, no unexpected ACL denials or UNKNOWN WORD.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

src/starkernel/repl.c

@@ -39,6 +39,7 @@
 #include "starkernel/homeblocks_sig.h"
 #include "starkernel/capsule_birth.h"
 #include "starkernel/capsule_zuse_boot.h"
+#include "starkernel/capsule_wirebind.h"
 #include "starkernel/capsule_run.h"
 #include "starkernel/vm/bootstrap/sk_vm_bootstrap.h"
 #include "block_subsystem.h"
@@ -195,6 +196,18 @@ static void sk_repl_idle(VM *active_vm)
              * detect it). No-ops immediately if Zuse already has a real
              * identity this boot. */
             capsule_zuse_boot_try_attach(&usb_blk_dev, sig_rc, &sig, (VM *)sk_get_mama_vm());
+
+            /* FABRIC-3.md §F.5/§F.23 (WIREBIND): the real thumbdrive-
+             * attach call site for a regular (non-Zuse) identity --
+             * verify-then-birth-then-pair, replacing the RUNCAP-TEST/
+             * PAIR-TEST diagnostic words that exercised each piece by
+             * hand. Only meaningful for a drive that actually checked
+             * out (HOMEBLOCKS_SIG_OK); capsule_wirebind_try_attach()
+             * itself no-ops for a genesis-mode Zuse drive (no cert
+             * region) or before Zuse has authenticated this boot. */
+            if (sig_rc == HOMEBLOCKS_SIG_OK) {
+                capsule_wirebind_try_attach(&usb_blk_dev, &sig, (VM *)sk_get_mama_vm());
+            }
         }
         if (rc == 0 && blk_subsys_attach_device(&usb_blk_dev) == BLK_OK) {
             xdev->bot_msc_attached = 1;