Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

FABRIC.md -> FABRIC-0.md
FABRIC-2.md -> FABRIC-1.md
FABRIC-3.md -> FABRIC-2.md (the current/living document)
FABRIC-4.md unchanged (new #3 to follow separately)

Every cross-reference repo-wide updated to match, including doc-comment
citations inside kernel source (.c/.h) files -- done via an ordered
placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md->
placeholder1, FABRIC.md->placeholder0, then placeholders resolved to
final names) in a single pass per file to avoid double-shifting
already-renamed references.

One line in capsules/font.4th grew past the 64-char block-format limit
as a side effect of the longer filename; shortened it and reverified
with mkcapsule --lint (34/34 pass) before rebuilding.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after the fix; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

include/starkernel/capsule_zuse_boot.h

@@ -9,7 +9,7 @@
 
 /**
  * capsule_zuse_boot.h - Thumbdrive-resident Zuse genesis/attach
- * (FABRIC-3.md §F.20/§F.21). Replaces kernel_main.c's old one-shot
+ * (FABRIC-2.md §F.20/§F.21). Replaces kernel_main.c's old one-shot
  * block-fence mint-or-load: Zuse's own identity now lives only on her
  * own minted thumbdrive, never system-resident. Since USB attach
  * detection only happens inside the idle loop (sk_repl_idle(), not at
@@ -60,7 +60,7 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
 
 /**
  * capsule_zuse_boot_logout - End Zuse's session when her own attached
- * drive detaches (FABRIC-3.md §I.8, re-scoped 2026-09-04: no identity is
+ * drive detaches (FABRIC-2.md §I.8, re-scoped 2026-09-04: no identity is
  * different here -- Zuse logs out on device removal exactly like a
  * WIREBIND user does, not via a Stadium-patron TTL. She has no separate
  * VM or blocks of her own, so unlike capsule_wirebind_eject()/