Phase D: RUNCAP -- runtime capsule construction from thumbdrive content

capsule_runcap_birth() (new capsule_runcap.h/.c): builds a heap-only,
single-entry CapsuleDirHeader + CapsuleDesc + CapsuleNameEntry + arena
from a home-blocks drive's identity_src region (skipping the first
devblock, reserved for MINT's user_identity_seed_t record) and hands it
to the existing, unmodified capsule_birth_baby() -- no new birth
mechanism, matching FABRIC-3.md §F.6's own trace.

Found and closed a real gap in that trace along the way:
capsule_birth_baby()'s signature check calls capsule_get_signatures(),
which unconditionally returns the compile-time-baked global array --
meaningless for a heap-built directory, where index 0 would compare
RUNCAP's own content against whatever real capsule happens to occupy
that slot in the baked array (guaranteed-wrong, not a security check).
Added an explicit skip_pki_sig flag (0 for all 4 existing call sites,
1 for RUNCAP): that content's trust comes from CERTVERIFY, a separate
root, not the capsule-PKI chain.

Also found live: capsule_birth_baby() never sets the registry entry's
own .name (every existing caller does this itself afterward via
capsule_vm_registry_set_name() -- RUNCAP now does too), and
capsule_exec_payload() requires a "Block NNNN" header per chunk of
content or it's silently skipped, never executed -- not a bug, but
necessary context for whoever authors MINT's default personality
content next.

Added a small accessor pair (repl.h/.c) exposing the currently attached
home-blocks device/sig -- the same gap F.9's own BINDSTEP scoping had
already flagged, needed by both.

Verified end-to-end live in QEMU: synthetic identity-source content
written directly to a thumbdrive image's raw devblocks (no capsule
build, no mkcapsule) was read, compiled, and executed by a genuinely
new VM via a diagnostic RUNCAP-TEST word -- confirmed via VM-EXEC
invoking a word defined only in that source. Clean 3-architecture
regression boot (no RUNCAP drive attached) confirms no side effects.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZGkimpfyh63EZyRkNbkPD

src/starkernel/capsule/capsule_birth.c

@@ -488,6 +488,7 @@ CapsuleRunResult capsule_birth_baby(
     const CapsuleDesc      *descs,
     const CapsuleNameEntry *names,
     const uint8_t          *arena,
+    int                     skip_pki_sig,
     VMUuid                 *out_vm_id,
     void                  **out_vm_ctx)
 {
@@ -507,8 +508,14 @@ CapsuleRunResult capsule_birth_baby(
 
     /* Milestone 6 (Phase 8): enforced only on INVALID -- see the fuller
      * comment in capsule_birth_mama() above for why MISSING/NO_ROOT_KEY
-     * stay WARN-only. */
-    {
+     * stay WARN-only. Skipped entirely when skip_pki_sig is set (RUNCAP,
+     * FABRIC-3.md §F.6/F.18): capsule_get_signatures() is the compile-
+     * time-baked array, indexed against the build-time capsule_descriptors[]
+     * -- meaningless for a heap-built directory sourced from a thumbdrive,
+     * where idx 0 would just compare against whatever real capsule happens
+     * to occupy that slot. That content's trust already comes from a
+     * separate root (CERTVERIFY, run by the caller before this). */
+    if (!skip_pki_sig) {
         int idx = (int)(cap - descs);
         CapsuleSigResult sr = capsule_verify_signature(
             descs, names, capsule_get_signatures(), arena, dir->desc_count, idx);