Phase D: RUNCAP -- runtime capsule construction from thumbdrive content

capsule_runcap_birth() (new capsule_runcap.h/.c): builds a heap-only,
single-entry CapsuleDirHeader + CapsuleDesc + CapsuleNameEntry + arena
from a home-blocks drive's identity_src region (skipping the first
devblock, reserved for MINT's user_identity_seed_t record) and hands it
to the existing, unmodified capsule_birth_baby() -- no new birth
mechanism, matching FABRIC-3.md §F.6's own trace.

Found and closed a real gap in that trace along the way:
capsule_birth_baby()'s signature check calls capsule_get_signatures(),
which unconditionally returns the compile-time-baked global array --
meaningless for a heap-built directory, where index 0 would compare
RUNCAP's own content against whatever real capsule happens to occupy
that slot in the baked array (guaranteed-wrong, not a security check).
Added an explicit skip_pki_sig flag (0 for all 4 existing call sites,
1 for RUNCAP): that content's trust comes from CERTVERIFY, a separate
root, not the capsule-PKI chain.

Also found live: capsule_birth_baby() never sets the registry entry's
own .name (every existing caller does this itself afterward via
capsule_vm_registry_set_name() -- RUNCAP now does too), and
capsule_exec_payload() requires a "Block NNNN" header per chunk of
content or it's silently skipped, never executed -- not a bug, but
necessary context for whoever authors MINT's default personality
content next.

Added a small accessor pair (repl.h/.c) exposing the currently attached
home-blocks device/sig -- the same gap F.9's own BINDSTEP scoping had
already flagged, needed by both.

Verified end-to-end live in QEMU: synthetic identity-source content
written directly to a thumbdrive image's raw devblocks (no capsule
build, no mkcapsule) was read, compiled, and executed by a genuinely
new VM via a diagnostic RUNCAP-TEST word -- confirmed via VM-EXEC
invoking a word defined only in that source. Clean 3-architecture
regression boot (no RUNCAP drive attached) confirms no side effects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

include/starkernel/repl.h

@@ -15,6 +15,9 @@
 #define STARKERNEL_REPL_H
 
 #include "vm.h"
+#include "starkernel/homeblocks_sig.h"
+
+struct blkio_dev;
 
 #ifdef __cplusplus
 extern "C" {
@@ -68,6 +71,16 @@ void sk_repl_set_active_vm(VM *vm);
  */
 VM *sk_repl_get_active_vm(void);
 
+/**
+ * sk_repl_get_homeblocks_dev / sk_repl_get_homeblocks_sig - The currently
+ * attached home-blocks USB drive, or NULL if none is attached / the
+ * attached drive didn't check out as HOMEBLOCKS_SIG_OK (FABRIC-3.md
+ * §F.6/§F.9/§F.18). Both return NULL together; never one without the
+ * other.
+ */
+struct blkio_dev *sk_repl_get_homeblocks_dev(void);
+const homeblocks_sig_t *sk_repl_get_homeblocks_sig(void);
+
 #ifdef __cplusplus
 }
 #endif