starkernel: item 3.8 -- VM identifiers as UUID/GUID

Punch list §25 item 3.8 complete. Added after starting item 4.1
surfaced the need to thread a vm_id into stadium_admit()'s new quota
parameter; Captain Bob ruled UUID/GUID rather than keeping the
narrower uint32_t.

New VMUuid type (vm_uuid.h/vm_uuid.c): two uint64_t halves, RFC-4122-
shaped for logging. Not real randomness -- checked directly against
QEMU 10.2.1's actual CPU feature set: amd64 RDRAND and riscv64 Zkr are
both real, available features here; aarch64 has no RNG property on any
CPU model including "max" (verified exhaustively via QMP
query-cpu-model-expansion). Captain Bob ruled a uniform fallback
across all three ISAs rather than a per-architecture split.

Fallback is a deterministic PRNG (splitmix64) seeded from the Mama
capsule's content hash, pre-filling a 16-entry FIFO pool at boot and
refilling with another batch of the same stream when exhausted --
exactly the shape requested. Same capsule booted twice produces the
same id sequence, preserving the dict_hash reproducibility this
session has relied on throughout.

Hera keeps a fixed, reserved all-zero id, not drawn from the pool --
capsule_birth.c uses vm_id == 0 as a load-bearing sentinel in three
places (KILL protection x2, fleet heat-fanout parent-chain
terminator), found by reading before writing any code.

Two real sentinel-collision bugs caught before shipping, same class as
STADIUM_CONTAINS_NONE: vm_uuid_none() (all-ones, not all-zero) for
"not yet assigned"/"no VM" placeholders; confirmed item 3.7's quota
table already used an in_use boolean rather than a vm_id sentinel, so
no second collision was actually possible there -- the dead,
never-referenced STADIUM_QUOTA_SLOT_EMPTY macro was removed.

Blast radius larger than first scoped, flagged mid-work rather than
silently absorbed: capsule_vm_physics.c/.h (the fleet heat-transfer
layer item 2.1 modified earlier this session) has its own vm_id-keyed
node table and walks parent_vm_id chains through the same identity
space, so it needed the same change, plus its callers in
mama_forth_words.c and sk_vm_bootstrap.c.

One live FORTH word contract changed, by explicit ruling: CAPSULE-BIRTH
was ( capsule-id -- vm-id ), a single cell -- can't hold 128 bits.
Captain Bob picked pushing two cells ("there is doubles support in the
FORTH std word set anyway"): ( capsule-id -- vm-id-hi vm-id-lo ).
MAMA-VM-ID changed the same way: ( -- 0 0 ).

Verified: full (not standalone-file) kernel rebuild to catch cross-file
breakage given the size of this change -- it surfaced the
capsule_vm_physics.c blast radius a narrower check would have missed.
Three-architecture boot (amd64, aarch64, riscv64), all reaching ok>
with identical dict_hash=0x3d4e1daf289da94f matching the item-3.7
baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/capsule/mama_forth_words.c

@@ -224,7 +224,7 @@ void mama_word_birth(VM *vm)
     const char     *src;
     char            lower[VM_NAME_MAX];
     CapsuleRunResult result;
-    uint32_t        new_vm_id;
+    VMUuid          new_vm_id;
 
     if (vm->dsp < 1) {
         vm->error = 1;
@@ -277,7 +277,7 @@ void mama_word_birth(VM *vm)
     { const char *suf = "init.4th"; for (i = 0; suf[i]; i++) capsule_name[j++] = suf[i]; }
     capsule_name[j] = '\0';
 
-    new_vm_id = 0;
+    new_vm_id = vm_uuid_none();
 
     /* Switch console prefix to the baby's name so its init capsule output
      * appears tagged [Hermes] / [Artemis] rather than [Hera]. */
@@ -468,8 +468,8 @@ void mama_word_use(VM *vm)
         return;
     }
 
-    /* vm_id 0 = Hera — restore default dispatch (NULL = use REPL's own vm) */
-    if (entry.vm_id == 0) {
+    /* Hera — restore default dispatch (NULL = use REPL's own vm) */
+    if (vm_uuid_is_hera(entry.vm_id)) {
         sk_repl_set_active_vm((void *)0);
     } else {
         sk_repl_set_active_vm((VM *)entry.vm_ptr);
@@ -763,9 +763,11 @@ static void mama_word_vm_call(VM *vm)
 }
 
 /**
- * @brief CAPSULE-BIRTH ( capsule-id -- vm-id )
+ * @brief CAPSULE-BIRTH ( capsule-id -- vm-id-hi vm-id-lo )
  * Birth a baby VM from a production (p) capsule.
- * Returns the new VM's ID, or -1 on failure.
+ * Returns the new VM's 128-bit ID as a double (item 3.8 -- FORTH already
+ * has double-cell words for exactly this), high cell on top, or
+ * vm_uuid_none()'s hi/lo (both all-ones) on failure.
  */
 void mama_word_capsule_birth(VM *vm)
 {
@@ -775,10 +777,11 @@ void mama_word_capsule_birth(VM *vm)
     }
 
     cell_t capsule_idx = vm_pop(vm);
-    uint32_t new_vm_id = 0;
+    VMUuid new_vm_id = vm_uuid_none();
 
     if ((uint64_t)capsule_idx >= capsule_get_desc_count()) {
-        vm_push(vm, (cell_t)-1);
+        vm_push(vm, (cell_t)new_vm_id.lo);
+        vm_push(vm, (cell_t)new_vm_id.hi);
         return;
     }
     const char *cap_name = capsule_get_names()[(uint32_t)capsule_idx].name;
@@ -793,11 +796,11 @@ void mama_word_capsule_birth(VM *vm)
         (void **)0  /* Don't need VM context back */
     );
 
-    if (result == CAPSULE_RUN_OK) {
-        vm_push(vm, (cell_t)new_vm_id);
-    } else {
-        vm_push(vm, (cell_t)-1);  /* Birth failed */
+    if (result != CAPSULE_RUN_OK) {
+        new_vm_id = vm_uuid_none();  /* Birth failed */
     }
+    vm_push(vm, (cell_t)new_vm_id.lo);
+    vm_push(vm, (cell_t)new_vm_id.hi);
 }
 
 /**
@@ -836,12 +839,14 @@ void mama_word_capsule_run(VM *vm)
  * ============================================================================ */
 
 /**
- * @brief MAMA-VM-ID ( -- 0 )
- * Push Mama's VM ID (always 0).
+ * @brief MAMA-VM-ID ( -- 0 0 )
+ * Push Mama's VM ID as a double (item 3.8): vm_uuid_hera() is all-zero,
+ * so both cells are 0. High cell on top, matching CAPSULE-BIRTH.
  */
 void mama_word_mama_vm_id(VM *vm)
 {
     vm_push(vm, 0);
+    vm_push(vm, 0);
 }
 
 /**
@@ -969,7 +974,7 @@ static void mama_word_connect_artemis(VM *vm __attribute__((unused)))
     if (capsule_vm_find_by_name_nocase("Artemis", &entry) != 0 ||
         entry.state == VM_STATE_DEAD ||
         entry.state == VM_STATE_STILLBORN) {
-        uint32_t new_vm_id = 0;
+        VMUuid new_vm_id = vm_uuid_none();
         const char *saved = console_get_vm_name();
         CapsuleRunResult r;
 
@@ -1040,7 +1045,7 @@ static void mama_word_connect_hermes(VM *vm __attribute__((unused)))
     if (capsule_vm_find_by_name_nocase("Hermes", &entry) != 0 ||
         entry.state == VM_STATE_DEAD ||
         entry.state == VM_STATE_STILLBORN) {
-        uint32_t new_vm_id = 0;
+        VMUuid new_vm_id = vm_uuid_none();
         const char *saved = console_get_vm_name();
         CapsuleRunResult r;