Add VMIdentity type, relocate homeblocks_sig_t off devblock 0

Phase A of the identity pipeline (FABRIC-3.md §F.2/§F.16, §F.13):

- New include/starkernel/vm_identity.h: VMIdentity{owner_pubkey[32],
  installed, acl_caps}, its own header per the project's "give real-shaped
  data its own header" convention (VMUuid's own precedent), embedded by
  value on struct VM. acl_caps is an independent capability bitmask, not
  an ordered privilege tier (decided 2026-08-28) -- Zuse isn't a
  structurally special VM, her identity just has every bit set
  (VM_IDENTITY_CAP_ALL). No individual capability bits assigned yet,
  deliberate slack matching blk_meta_t's own acl_reserved precedent --
  real bits get names once the operation they gate (BINDSTEP, MINT, ...)
  actually gets built.

- Applied the devblock-1 relocation decided in §F.13: new
  HOMEBLOCKS_SIG_START_FBLOCK constant (homeblocks_sig.h), repl.c's
  homeblocks_sig_check() call site updated from the literal 0. Also
  applied the still-owed blockmap_offset/blockmap_devblocks ->
  identity_src_offset/identity_src_devblocks rename decided in §F.6 (no
  other code referenced the old names). Updated the header's own stale
  GPT-relative doc comments to match -- GPT was dropped permanently, this
  location is final, not an interim stand-in.

Verified live on all three architectures: clean compile, clean boot to
ok>, Hermes/Artemis both confirmed live with no KILL (no regression from
last session's session-less fix). One pre-existing, unrelated anomaly
observed consistently on all three arches, not caused by this change (no
code touched here intersects Zuse's own fence-write path): "Zuse: minted
but fence write FAILED (not persistent)" -- flagged for its own
investigation, not chased here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/vm.h

@@ -359,6 +359,7 @@ typedef enum
 
 #ifdef __STARKERNEL__
 #include "starkernel/vm_uuid.h" /* VMUuid -- item 4.2, VM.stadium_vm_id */
+#include "starkernel/vm_identity.h" /* VMIdentity -- FABRIC-3.md §F.2/§F.16 */
 
 /* Saved interpreter state for VM lifecycle calls (BIRTH, VM-EXEC, START).
  * Dynamically allocated; grows on demand via sf_realloc. */
@@ -554,6 +555,15 @@ typedef struct VM
                             *   ran the word, instead of item 4.1's hardcoded
                             *   vm_uuid_hera(). */
     /** @} */
+
+    /** @name Owner identity + ACL capabilities (FABRIC-3.md §F.2/§F.16)
+     * @{
+     */
+    VMIdentity identity; /**< This VM's owning identity. installed=0 (the
+                           *   zero-init default) means no lock -- every
+                           *   VM today, until D.5's per-VM-identity work
+                           *   and CERTVERIFY/MINT actually populate it. */
+    /** @} */
 #endif
 } VM;