Add VMIdentity type, relocate homeblocks_sig_t off devblock 0

Phase A of the identity pipeline (FABRIC-3.md §F.2/§F.16, §F.13):

- New include/starkernel/vm_identity.h: VMIdentity{owner_pubkey[32],
  installed, acl_caps}, its own header per the project's "give real-shaped
  data its own header" convention (VMUuid's own precedent), embedded by
  value on struct VM. acl_caps is an independent capability bitmask, not
  an ordered privilege tier (decided 2026-08-28) -- Zuse isn't a
  structurally special VM, her identity just has every bit set
  (VM_IDENTITY_CAP_ALL). No individual capability bits assigned yet,
  deliberate slack matching blk_meta_t's own acl_reserved precedent --
  real bits get names once the operation they gate (BINDSTEP, MINT, ...)
  actually gets built.

- Applied the devblock-1 relocation decided in §F.13: new
  HOMEBLOCKS_SIG_START_FBLOCK constant (homeblocks_sig.h), repl.c's
  homeblocks_sig_check() call site updated from the literal 0. Also
  applied the still-owed blockmap_offset/blockmap_devblocks ->
  identity_src_offset/identity_src_devblocks rename decided in §F.6 (no
  other code referenced the old names). Updated the header's own stale
  GPT-relative doc comments to match -- GPT was dropped permanently, this
  location is final, not an interim stand-in.

Verified live on all three architectures: clean compile, clean boot to
ok>, Hermes/Artemis both confirmed live with no KILL (no regression from
last session's session-less fix). One pre-existing, unrelated anomaly
observed consistently on all three arches, not caused by this change (no
code touched here intersects Zuse's own fence-write path): "Zuse: minted
but fence write FAILED (not persistent)" -- flagged for its own
investigation, not chased here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

src/starkernel/repl.c

@@ -121,14 +121,12 @@ static void sk_repl_idle(VM *active_vm)
              * belongs on the write path, once WRITE(10) gives it something
              * to gate.
              *
-             * sig_start_fblock = 0: correct for today's unpartitioned raw
-             * test/real media (no GPT parser exists yet -- see
-             * homeblocks_sig.h's own doc). Will need to become a real
-             * GPT-partition-relative lookup once that parser lands; this is
-             * the one place that changes, isolated from homeblocks_sig.c's
-             * own location-agnostic check. */
+             * HOMEBLOCKS_SIG_START_FBLOCK (devblock 1): the real, final
+             * location -- GPT was dropped permanently, this is not an
+             * interim value (FABRIC-3.md §F.8/§F.13). */
             homeblocks_sig_t         sig;
-            homeblocks_sig_result_t  sig_rc = homeblocks_sig_check(&usb_blk_dev, 0, &sig);
+            homeblocks_sig_result_t  sig_rc =
+                homeblocks_sig_check(&usb_blk_dev, HOMEBLOCKS_SIG_START_FBLOCK, &sig);
             switch (sig_rc) {
                 case HOMEBLOCKS_SIG_OK:
                     console_println("xhci: USB drive recognized as a home-blocks drive");