Retire emergency CLI: Zuse goes thumbdrive-resident, ACL.4th activated

Three tightly-coupled changes, verified together per Captain Bob's own
"getting rid of the emergency cli" direction:

1. Zuse's identity is thumbdrive-resident, never system-resident. New
   zuse_genesis_marker_t (magic/version/zuse_pubkey[32]/crc) replaces
   zuse_cert_devblock_t's slot in the top-of-device fence -- the system
   now remembers only that a root identity exists and its pubkey, never
   a seed. zuse_cert_devblock_t is kept in the repo, marked superseded,
   no longer written by any code path.

   capsule_mint_identity() grows a genesis mode (issuer_vm=NULL): no
   cert is built or written (Zuse isn't verified against a separate
   signer -- she's recognized by pubkey match against the marker) and
   two new optional out-params (out_pubkey/out_seed) let the caller
   install the cert immediately after a genesis mint.

   New capsule_zuse_boot_try_attach() (capsule_zuse_boot.c), called
   from sk_repl_idle() on every fresh USB attach (the only point in the
   boot lifecycle a thumbdrive can actually be detected -- attach
   polling doesn't exist yet at kernel_main.c's old one-shot mint point,
   which is why that whole block is gone): no marker + blank drive ->
   genesis-mint; marker present + matching drive -> read its own
   user_identity_seed_t, install the cert. Either way, re-runs
   ACL-ZUSE-BOOT (zuse.4th) so zuse_session activates exactly like it
   always has for a same-boot cert install -- ACL-PIN only blocks
   redefinition, not re-execution, so no new C-side auth logic needed.

2. ACL.4th activated (capsules/init.4th) -- inactive all session until
   now. Found and fixed a real bug this immediately surfaced: zuse.4th's
   ACL-ZUSE-BOOT tried `['] ACL-ZUSE-BOOT ACL-PIN` from inside its own
   still-compiling definition -- the word isn't findable yet at that
   point, so the whole definition silently failed to compile every
   previous boot this session (dormant, since ACL.4th never loaded).
   Fixed: pin after the definition closes, not from within it -- it
   only needs to happen once anyway, and pinning doesn't block the
   re-invocation genesis/attach needs.

3. The unauthenticated emergency-CLI ACL bypass is retired
   (repl.c): `emergency_console = is_hera ? (zuse_session ? 0 : 1) : 0`
   deleted from both sk_repl_step and sk_repl_run. Every word run from
   Hera's own bare prompt now goes through ordinary ACL enforcement;
   emergency_console is driven only by the genuine C-level fault
   handler again.

Added ZUSE-SESSION? (starforth_words.c), a read-only diagnostic
matching ZUSE-PUBKEY@'s own precedent, to verify the whole chain
directly rather than by inference.

Verified end-to-end live in QEMU: fresh boot, no thumbdrive ->
ZUSE-SESSION? reads 0. Attach a genuinely blank drive via QMP -> genesis
mint fires automatically (no typing) -> ZUSE-SESSION? reads -1 (true).
Hermes/Artemis both birth clean on all three architectures with ACL
now actually enforced for the first time all session -- no denials, no
UNKNOWN WORD beyond the deliberate POST self-test cases.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/starkernel/capsule_mint.h

@@ -58,16 +58,33 @@ typedef enum {
  * @param dev        Already-open block device for the target drive.
  * @param issuer_vm  The signing identity -- in practice always Hera's own
  *                   VM (Zuse's cert lives there, vm.h's zuse_cert_seed).
+ *                   NULL means genesis mode (§F.21): no cert is built or
+ *                   written (cert_offset/cert_devblocks stay 0) and
+ *                   issuer_vm->zuse_cert_installed is never checked --
+ *                   used exactly once, to mint Zuse's own root identity,
+ *                   which by definition has no existing Zuse to sign it.
  * @param full_name  Required, NUL-terminated, fits user_identity_seed_t's
  *                   full_name field (§F.20).
  * @param username   Required, NUL-terminated, fits its username field.
  * @param email      NULL or empty string = null (field stays empty).
  * @param phone      NULL or empty string = null (field stays empty).
+ * @param out_pubkey Optional (may be NULL): filled with the newly
+ *                   generated identity's own Ed25519 public key on
+ *                   success. Genesis mode's only caller needs this, to
+ *                   write it into the system-resident zuse_genesis_
+ *                   marker_t.
+ * @param out_seed   Optional (may be NULL): filled with the newly
+ *                   generated identity's own Ed25519 seed on success.
+ *                   Genesis mode's only caller needs this too, to
+ *                   install the cert into Hera's own VM immediately
+ *                   (vm_zuse_cert_install()) -- the seed otherwise only
+ *                   ever lives on the minted thumbdrive.
  * @return MINT_OK on success, an error code otherwise.
  */
 MintResult capsule_mint_identity(struct blkio_dev *dev, VM *issuer_vm,
                                   const char *full_name, const char *username,
-                                  const char *email, const char *phone);
+                                  const char *email, const char *phone,
+                                  uint8_t out_pubkey[32], uint8_t out_seed[32]);
 
 #endif /* __STARKERNEL__ */