Stage 3 follow-on: fix stack-ownership corruption + DoE switch columns (FABRIC-3.md §XXVIII.1)

DoE CSV gained 6 switch-signal columns (switch_count_cumulative,
switch_current_slot, switch_*_readiness, switch_ticks_since), and verifying
them with a boot-time HB-ON probe surfaced a real livelock: the preemption
checkpoint could fire inside a VM-EXEC-nested execute_colon_word() call and
switch away from a stack it didn't own, parking a borrowed region of the
caller's stack under the wrong VM's saved-context pointer. The trampoline
bounce was the visible (safe) half of this; the corruption was the quiet
half, live in every prior "clean" Stage 3 boot without ever showing up in
the log.

Fixed by gating the checkpoint on being at the outermost vm_interpret()
call (g_vm_interpret_depth / sk_vm_at_outermost_interpret(), vm_core.c),
per Bob's decision. Also fixed two related bugs found in the same pass:
g_switch_back_to was a single global stale after first entry, now per-VM
state (native_switch_back_to); note_switch_performed() fired on resume
instead of switch-out, now called before the switch.

Verified on all 3 architectures: steady log growth (no freeze), zero
leaked QEMU processes, DoE columns internally consistent, Hermes/Artemis
confirmed genuinely executing (not just trampoline-bouncing). Temporary
HB-ON boot probe reverted after capture.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016UNhH1mhi52i6Qihh7ZV5S

include/starkernel/capsule_vm_switch_signal.h

@@ -56,6 +56,7 @@
 
 #ifdef __STARKERNEL__
 
+#include <stdint.h>
 #include "starkernel/vm_uuid.h"
 
 /* Register a VM as a switch-signal participant. Returns its slot index,
@@ -74,6 +75,22 @@ void sk_vm_switch_signal_tick(void);
  * pending flag as a side effect -- call at most once per checkpoint. */
 VMUuid sk_vm_switch_signal_take_pending(void);
 
+/* Call once, from the same checkpoint, immediately after a switch
+ * sk_vm_switch_signal_take_pending() requested actually executes (not if
+ * the target turned out invalid/self) -- feeds the DoE CSV counters
+ * below. */
+void sk_vm_switch_signal_note_switch_performed(void);
+
+/* DoE CSV read-only exposure (FABRIC-3.md §XXVIII Stage 3 follow-on,
+ * 2026-09-13) -- all of this state already existed for the switch
+ * decision itself; these just make it observable. */
+uint64_t sk_vm_switch_signal_switch_count(void);      /* cumulative, since boot */
+uint32_t sk_vm_switch_signal_ticks_since_switch(void);
+int      sk_vm_switch_signal_current_slot(void);       /* -1 = none/unregistered */
+int      sk_vm_switch_signal_slot_count(void);
+uint32_t sk_vm_switch_signal_readiness(int slot);      /* 0 if slot out of range */
+uint32_t sk_vm_switch_signal_readiness_of(VMUuid vm_id); /* 0 if not registered */
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_CAPSULE_VM_SWITCH_SIGNAL_H */