FABRIC-2.md Category B: single-owner heartbeat physical-timer re-arm

Only Hera writes the shared physical timer period now, gated by
vm_uuid_is_hera(vm->stadium_vm_id) in vm_tick_inference_engine(). Every
other VM's Loop #7 still adapts its own tick_target_ns as before, it just
no longer races to re-arm the one physical timer.

Includes 3-arch acceptance run (amd64/aarch64/riscv64, all booted clean
to ok>) and regenerated capsule/DoE artifacts.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/vm/vm_runtime.c

@@ -752,7 +752,18 @@ void vm_tick_inference_engine(VM* vm)
          * rescale onto the kernel's 10 ms base rather than the hosted
          * HEARTBEAT_TICK_NS (10 µs) base -- see §26.3 for why the literal
          * value cannot be used on bare-metal hardware. heartbeat.c clamps
-         * defensively on the way in, so no clamping is duplicated here. */
+         * defensively on the way in, so no clamping is duplicated here.
+         *
+         * FABRIC-2.md, Category B "Multi-VM heartbeat ownership", ruled:
+         * there is exactly one physical timer, so exactly one VM may write
+         * its period -- never a race between whichever VM's vm_tick() last
+         * ran. Hera is the fixed point everywhere else in this design
+         * (patron zero, sole capacity arbiter, sole birther/killer of
+         * VMs), so she is the sole owner here too. Every other VM's Loop #7
+         * still adapts vm->heartbeat.tick_target_ns exactly as before --
+         * that's correct per-VM bookkeeping -- it simply never reaches the
+         * shared physical re-arm period. */
+        if (vm_uuid_is_hera(vm->stadium_vm_id))
         {
             const uint64_t kernel_base_ns = 10000000ULL; /* 10 ms, matches heartbeat.c's HEARTBEAT_BASE_PERIOD_NS */
             uint64_t kernel_period_ns =