starkernel: item 2.2 complete -- bound the VM registry

Wires the birth-refusal check into capsule_birth_baby(): calls
vm_registry_live_count() (added in the prior WIP commit) between
capsule validation and vm_registry_alloc(), returning the new
CAPSULE_RUN_ERR_FLEET_FULL and logging via
capsule_parity_log_birth_failed() before any EMBRYO registry slot is
consumed.

Also fixes a gap in that WIP commit: STADIUM_MAX_VM_COUNT was only
ever defined via a Kconfig .config-driven -D flag, with no fallback
default the way every sibling knob in starforth_config.h has -- a
build with no .config present (this one) failed with the macro
undeclared. Added STARFORTH_CONFIG_STADIUM_MAX_VM_COUNT_DEFAULT (4,
matching Kconfig.kernel) following the existing HEARTBEAT_INFERENCE_FREQUENCY
pattern exactly.

All three architectures boot clean to ok> with dict_hash=0x3d4e1daf289da94f,
matching the item-0.10/2.1 baseline. FABRIC.md item 2.2 checked off.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/capsule/capsule_birth.c

@@ -33,6 +33,7 @@
 #include "starkernel/console.h"
 #include "vm.h"
 #include "platform_alloc.h"
+#include "starforth_config.h" /* STADIUM_MAX_VM_COUNT */
 
 /*===========================================================================
  * VM Execution Hooks
@@ -438,6 +439,12 @@ CapsuleRunResult capsule_birth_baby(
     CapsuleValidateResult vr = capsule_validate(cap, arena, dir->arena_size, 1);
     if (vr != CAPSULE_VALID) return CAPSULE_RUN_ERR_INVALID;
 
+    if (vm_registry_live_count() >= STADIUM_MAX_VM_COUNT) {
+        capsule_parity_log_birth_failed(0, cap->capsule_id,
+            CAPSULE_RUN_ERR_FLEET_FULL, 0);
+        return CAPSULE_RUN_ERR_FLEET_FULL;
+    }
+
     VMRegistryEntry *entry = vm_registry_alloc();
     if (!entry) return CAPSULE_RUN_ERR_INVALID;