starkernel: item 3.8 -- VM identifiers as UUID/GUID

Punch list §25 item 3.8 complete. Added after starting item 4.1
surfaced the need to thread a vm_id into stadium_admit()'s new quota
parameter; Captain Bob ruled UUID/GUID rather than keeping the
narrower uint32_t.

New VMUuid type (vm_uuid.h/vm_uuid.c): two uint64_t halves, RFC-4122-
shaped for logging. Not real randomness -- checked directly against
QEMU 10.2.1's actual CPU feature set: amd64 RDRAND and riscv64 Zkr are
both real, available features here; aarch64 has no RNG property on any
CPU model including "max" (verified exhaustively via QMP
query-cpu-model-expansion). Captain Bob ruled a uniform fallback
across all three ISAs rather than a per-architecture split.

Fallback is a deterministic PRNG (splitmix64) seeded from the Mama
capsule's content hash, pre-filling a 16-entry FIFO pool at boot and
refilling with another batch of the same stream when exhausted --
exactly the shape requested. Same capsule booted twice produces the
same id sequence, preserving the dict_hash reproducibility this
session has relied on throughout.

Hera keeps a fixed, reserved all-zero id, not drawn from the pool --
capsule_birth.c uses vm_id == 0 as a load-bearing sentinel in three
places (KILL protection x2, fleet heat-fanout parent-chain
terminator), found by reading before writing any code.

Two real sentinel-collision bugs caught before shipping, same class as
STADIUM_CONTAINS_NONE: vm_uuid_none() (all-ones, not all-zero) for
"not yet assigned"/"no VM" placeholders; confirmed item 3.7's quota
table already used an in_use boolean rather than a vm_id sentinel, so
no second collision was actually possible there -- the dead,
never-referenced STADIUM_QUOTA_SLOT_EMPTY macro was removed.

Blast radius larger than first scoped, flagged mid-work rather than
silently absorbed: capsule_vm_physics.c/.h (the fleet heat-transfer
layer item 2.1 modified earlier this session) has its own vm_id-keyed
node table and walks parent_vm_id chains through the same identity
space, so it needed the same change, plus its callers in
mama_forth_words.c and sk_vm_bootstrap.c.

One live FORTH word contract changed, by explicit ruling: CAPSULE-BIRTH
was ( capsule-id -- vm-id ), a single cell -- can't hold 128 bits.
Captain Bob picked pushing two cells ("there is doubles support in the
FORTH std word set anyway"): ( capsule-id -- vm-id-hi vm-id-lo ).
MAMA-VM-ID changed the same way: ( -- 0 0 ).

Verified: full (not standalone-file) kernel rebuild to catch cross-file
breakage given the size of this change -- it surfaced the
capsule_vm_physics.c blast radius a narrower check would have missed.
Three-architecture boot (amd64, aarch64, riscv64), all reaching ok>
with identical dict_hash=0x3d4e1daf289da94f matching the item-3.7
baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/capsule/capsule_run.c

@@ -67,7 +67,7 @@ void capsule_run_log_init(void) {
     /* Zero the ring buffer */
     for (uint32_t i = 0; i < CAPSULE_MAX_RUN_RECORDS; i++) {
         run_log[i].run_id = 0;
-        run_log[i].vm_id = 0;
+        run_log[i].vm_id = vm_uuid_none(); /* not {0,0} -- that's Hera's reserved id (item 3.8) */
         run_log[i].reserved = 0;
         run_log[i].capsule_id = 0;
         run_log[i].capsule_hash = 0;
@@ -158,6 +158,14 @@ static void parity_put_hex64(uint64_t val) {
     PARITY_EMIT(buf);
 }
 
+/* item 3.8: VMUuid printed as its two hex64 halves, hyphen-separated --
+ * reuses parity_put_hex64 rather than a new hex-formatting routine. */
+static void parity_put_uuid(VMUuid id) {
+    parity_put_hex64(id.hi);
+    PARITY_EMIT("-");
+    parity_put_hex64(id.lo);
+}
+
 static void parity_put_u32(uint32_t val) {
     char buf[12];
     int i = 11;
@@ -189,7 +197,7 @@ static void parity_put_u64(uint64_t val) {
 }
 
 void capsule_parity_log_birth(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     uint64_t capsule_hash,
     uint64_t dict_hash)
@@ -197,7 +205,7 @@ void capsule_parity_log_birth(
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:BIRTH vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" capsule_id=");
     parity_put_hex64(capsule_id);
     PARITY_EMIT(" mode=p capsule_hash=");
@@ -208,7 +216,7 @@ void capsule_parity_log_birth(
 }
 
 void capsule_parity_log_birth_failed(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     CapsuleRunResult error,
     uint64_t partial_dict_hash)
@@ -216,7 +224,7 @@ void capsule_parity_log_birth_failed(
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:BIRTH_FAILED vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" capsule_id=");
     parity_put_hex64(capsule_id);
     PARITY_EMIT(" error=");
@@ -227,7 +235,7 @@ void capsule_parity_log_birth_failed(
 }
 
 void capsule_parity_log_run(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t run_id,
     uint64_t capsule_id,
     uint64_t pre_dict_hash,
@@ -236,7 +244,7 @@ void capsule_parity_log_run(
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:RUN vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" run_id=");
     parity_put_u64(run_id);
     PARITY_EMIT(" capsule_id=");
@@ -268,12 +276,12 @@ void capsule_parity_log_mama_init(
     PARITY_EMIT("\n");
 }
 
-void capsule_parity_log_kill(uint32_t vm_id, const char *name)
+void capsule_parity_log_kill(VMUuid vm_id, const char *name)
 {
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:KILL vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" name=");
     if (name) PARITY_EMIT(name);
     PARITY_EMIT("\n");