starkernel: item 3.6 -- Hera as patron zero, pinned (Phase 3 core complete)

Punch list §25 item 3.6 complete. Phase 3 (§25.4) core is now done:
items 3.1-3.6 all closed.

stadium_evict() now panics via sk_hal_panic() if a resident cell 0
(Hera, patron zero by construction of §6's boot order) is ever
selected for eviction. Placement is deliberate: the check runs before
the pin/contains refusal checks, not after -- if it ran after, a
wrongly-cleared pin would let the ordinary refusal path quietly return
-1 instead of ever reaching the panic, defeating the point of a check
that's supposed to be independent of pin holding.

Per §20.5 #3's explicit wording, not implemented as a filter:
stadium_admit()'s least-dense search is unchanged, still relying on
the general pin skip from item 3.5. Adding a second filter there would
have done exactly what that section warns against ("filtering hides
the bug, asserting reports it").

The panic path is, and will remain, unexercised by the acceptance
mechanism: sk_hal_panic() halts the machine, and triggering it
deliberately is incompatible with the three-arch boot being this
project's sole acceptance test. Correctness rests on the placement
argument, not a test -- same honesty precedent as items 3.4 and 3.5's
other unexercised paths.

Verified: three-architecture boot (amd64, aarch64, riscv64), all
reaching ok> with identical dict_hash=0x3d4e1daf289da94f matching the
item-3.5 baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/vm/stadium.c

@@ -37,6 +37,7 @@
 #include "starkernel/kmalloc.h"
 #include "starkernel/pmm.h"
 #include "starkernel/console.h"
+#include "starkernel/hal/hal.h"
 
 static StadiumCell *stadium_cell_array   = (StadiumCell *)0;
 static uint8_t      *stadium_bitmap       = (uint8_t *)0;
@@ -188,6 +189,11 @@ static void bitmap_clear(size_t cell_index) {
  * pinned header (§3) or one with a non-none `contains` (item 1.1: a patron
  * holding another cannot be reaped). Refuses an out-of-range index or a cell
  * whose discriminator bit is not set -- nothing resident there to reap.
+ *
+ * §20.5 #3 / item 3.6: panics, does not return, if a resident cell 0 (Hera,
+ * patron zero) is ever selected -- checked before pin/contains below, on
+ * purpose, so a wrongly-cleared pin cannot silently swallow the violation
+ * via the ordinary refusal path instead of surfacing it.
  */
 int stadium_evict(size_t cell_index) {
     StadiumPatronHeader *header;
@@ -195,6 +201,10 @@ int stadium_evict(size_t cell_index) {
     if (cell_index >= stadium_ncells) return -1;
     if (!bitmap_get(cell_index)) return -1;
 
+    if (cell_index == STADIUM_HERA_CELL_INDEX) {
+        sk_hal_panic("Stadium: eviction selected patron zero (Hera) -- governor invariant broken");
+    }
+
     header = &stadium_cell_array[cell_index].header;
     if (header->flags & STADIUM_FLAG_PIN) return -1;
     if (header->contains != STADIUM_CONTAINS_NONE) return -1;