Fix stadium_grant_quota() donor floor; rerun std79 DoE clean, 81/81 (FABRIC-3.md §XVII)

capsule_birth.c hardcoded every new VM's initial Stadium quota grant to split
from Hera specifically. Since a grant always halves whatever the donor
currently has, Hera's own free list converges toward empty after a bounded
number of grants — independent of whether the Stadium as a whole still had
spare capacity, since VMs she'd granted to earlier typically still held
nearly all of their own share untouched. Past that point every subsequent
VM birth's Stadium grant would be silently refused (soft-failed, non-fatal
by existing design), even with plenty of capacity sitting idle elsewhere.

Fixed by adding an O(1)-maintained free_count to StadiumVMQuota (incremented
in stadium_evict(), decremented at both of stadium_admit()'s free-list-pop
sites, set/adjusted in stadium_grant_quota()'s own split — this also let
grant_quota drop its old O(free-list length) counting walk in favor of an
O(1) read) and stadium_best_donor(), an O(live VM count) scan over quota
slots returning whichever in-use VM currently has the most free cells.
capsule_birth.c's birth path now splits from that VM instead of
unconditionally vm_uuid_hera().

Verified with another full rerun of the 3x9x3 std79 DoE campaign from
scratch — same discipline as the prior Stadium fix (any defect repair
reruns the whole DoE from the top) — one continuous boot per architecture,
all 9 identities simultaneously live throughout. 81/81 trials correct, 0
mismatches, DOE-RUN header sequence md5-identical to every prior run.
aarch64 ~280s total (vs ~290s for the O(ncells)-scan fix alone — confirms
no regression). Both known Stadium defects are now closed together on one
clean campaign rerun.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo

include/starkernel/vm/stadium.h

@@ -495,6 +495,24 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);
  */
 int stadium_grant_quota(VMUuid new_vm_id, VMUuid from_vm_id);
 
+/*
+ * stadium_best_donor - FABRIC-3.md SXVI donor-floor fix: the currently
+ * in-use VM with the largest free (unclaimed) cell count right now, i.e.
+ * the VM stadium_grant_quota()'s `from_vm_id` argument should be for a new
+ * VM's initial grant. Callers should NOT hardcode vm_uuid_hera() here --
+ * always splitting from Hera specifically converges her own free list
+ * toward empty after a bounded number of grants (each halves what remains)
+ * even while other, previously-granted VMs still hold nearly all of their
+ * own share untouched, silently starving later births though the Stadium
+ * as a whole has plenty of spare capacity. O(stadium_max_vm_count()) --
+ * a scan over quota slots (bounded by live VM population), not cells.
+ *
+ * @return The VM with the most free cells, or vm_uuid_none() if no VM
+ *         holds a quota yet (Stadium not initialized, or called before
+ *         Hera's own boot-time grant/admission).
+ */
+VMUuid stadium_best_donor(void);
+
 /*
  * stadium_cell_heat_get - Read a resident cell's own heat (FABRIC-0.md item
  * 4.2's fourth ruling). Requires cell_index to be resident AND owned by