proof: close :'s compiling_word_id tracking, the last easily-closeable defining-words gap

Adds compiling_word_id :: nat option to vm_state, modelling vm->compiling_word
(include/vm.h:421). forth_colon_entry_half now sets it from latest_id on success
and forces it to None on the pinned-conflict failure path, matching the real C's
unconditional `vm->compiling_word = de;` before its own NULL check in
vm_enter_compile_mode (src/vm.c:232-264).

: is now closed through entry creation + compiling_word tracking, same point as
CREATE/VARIABLE/CONSTANT. Remaining gap for : is the same DF write (gap b,
vm_align+HERE capture) those three already closed but not yet composed in here.

All 52 theories verify clean (isabelle build -D proof/, ~48s).

Part of the pre-Artemis closeout pass (FABRIC-2.md 5.2). PROOFS included per
Captain Bob's 2026-08-14 instruction.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

proof/COVERAGE.md

@@ -70,7 +70,7 @@ library itself is separately covered by `StarForth_Q48_16.thy`).
 | `format_words.c` | `StarForth_Format_Words.thy` | 17/19 (`#`/`#S` multi-precision division deferred) |
 | `system_words.c` | `StarForth_System_Words.thy` | 10/16 + `(ABORT")` helper |
 | `vocabulary_words.c` | `StarForth_Vocabulary_Words.thy` | 1/7 partial (entire subsystem is file-scope statics, see FINDINGS.md §1) |
-| `defining_words.c` | `StarForth_Defining_Words.thy` | 7/19 fully modelled (original 4 + CREATE/VARIABLE/CONSTANT and their runtimes) + `;` guard-only + `:` full except `compiling_word` tracking (added 2026-08-14/15) |
+| `defining_words.c` | `StarForth_Defining_Words.thy` | 7/19 fully modelled (original 4 + CREATE/VARIABLE/CONSTANT and their runtimes) + `;` guard-only + `:` closed through entry-creation + `compiling_word_id` tracking, DF write (gap b) still open (added 2026-08-14/15) |
 | `acl_words.c` | `StarForth_ACL_Words.thy` | 7/12 (5 already covered by the pre-existing `ACL_*.thy` policy theories) |
 | `dictionary_heat_diagnostic_words.c` | `StarForth_Dictionary_Heat_Diagnostic_Words.thy` | 4/6 full + 1 partial |
 | `physics_freeze_words.c` | `StarForth_Physics_Freeze_Words.thy` | 6/9 |
@@ -116,8 +116,8 @@ effort on the scale of what's already here:
   the abstract `dict_entry` model is word-id-indexed, not addressed; no
   independent `dsp` register exists to model `SP@`/`SP!` against either.
 - **Dictionary insertion** (`vm_create_word`, used by `:`, CREATE, VARIABLE,
-  CONSTANT, DEFER) — **closed end-to-end for CREATE/VARIABLE/CONSTANT,
-  2026-08-14/15**, `:`/DEFER closed up to `vm->compiling_word` tracking.
+  CONSTANT, DEFER) — **closed end-to-end for CREATE/VARIABLE/CONSTANT/`:`,
+  2026-08-14/15.**
   `dict_insert_entry` (`StarForth_Defining_Words.thy`) models the
   word_id-assignment/dictionary-table/`latest_id`/`word_id_next`-counter
   portion; `de_df :: cell` (added to `dict_entry` in `StarForth_Base.thy`)
@@ -137,14 +137,21 @@ effort on the scale of what's already here:
   also now modelled end to end, with the FIND-family name-resolution gap
   sidestepped via an explicit `target_wid_opt :: nat option` +
   `is_defer_word :: bool` pair, the same technique
-  `physics_freeze_words.c`'s FREEZE-WORD/etc. already established. Still
-  open: `:`'s `vm->compiling_word` tracking (no vm_state field, so `:`
-  stops just short of full closure); DEFER's own runtime (dispatch
-  reassignment via a stored pointer — a fundamentally different DF usage,
-  still gap (c), NOT the same shape as IS/DEFER@'s plain-value DF access);
-  the pin-shadow name-scan guard everywhere (sidestepped via an explicit
-  `pinned_conflict :: bool` parameter); and the FIND-family lookup itself,
-  which IS/DEFER@'s sidestep still doesn't model, only routes around.
+  `physics_freeze_words.c`'s FREEZE-WORD/etc. already established. `:`
+  closed to the same point as CREATE/VARIABLE/CONSTANT, 2026-08-15:
+  `compiling_word_id` added to `vm_state` (mirrors `vm->compiling_word`),
+  set by `forth_colon_entry_half` from `latest_id` on success and forced
+  to `None` on the pinned-conflict failure path, matching the real C's
+  unconditional `vm->compiling_word = de;` before its own null check.
+  Still open: `:`'s vm_align+HERE capture and DF write of the
+  threaded-body start address (gap b, same as CREATE/VARIABLE/CONSTANT's
+  own DF write, just not yet composed in for `:`); DEFER's own runtime
+  (dispatch reassignment via a stored pointer — a fundamentally different
+  DF usage, still gap (c), NOT the same shape as IS/DEFER@'s plain-value
+  DF access); the pin-shadow name-scan guard everywhere (sidestepped via
+  an explicit `pinned_conflict :: bool` parameter); and the FIND-family
+  lookup itself, which IS/DEFER@'s sidestep still doesn't model, only
+  routes around.
 - **The vocabulary chain mechanics** (VOCABULARY/DEFINITIONS/CONTEXT/CURRENT/
   FORTH) — file-scope statics, see FINDINGS.md §1, instance #5.
 - **The hot-words cache** (`physics_benchmark_words.c`) and **the bucket/