feat(v4.0.0): hosted golden model, single node

First code for StarForth v4 (JUSTIFICATION.md section 10, step 1): one node
of the 32-instruction core as a C99 model, with cell width as a build
parameter.

- Node: P, A, B, F18 circular stacks (10 and 9 deep, D-2), word-addressed
  memory (D-1), 5% guard bands on every bounded list.
- Instruction word: six 5-bit slots in 32 bits at every cell width.
- Executor: all 32 opcodes of DECOMPOSITION.md 1.3. Cell arithmetic wraps
  explicitly; no signed overflow or implementation-defined shift.
- Heat: per-opcode and per-call-target counters and the anti-clock, driven
  by instruction retirement (1.4, D-6 interim).
- Slot packer and runner for tests, and a reference unsigned multiply in
  plain C99 with no 128-bit type.

Tests run at 32- and 64-bit cells, and under ASan and UBSan. They cover
every opcode and execute the first section 4 definitions (NIP SWAP OR
NEGATE ROT 0< 0= 2DUP - U<) against the C operation each stands for.

UM* as written in section 4 is exact only while u1 <= 2^(n-2). Two known
failing cases are pinned in test_foundation.c until it is rewritten.

DECOMPOSITION.md: record D-9, the instruction word is 32 bits at every
cell width (ruled 2026-10-02).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/src/node.c

@@ -0,0 +1,35 @@
+/* node.c -- the v4 node.  See node.h. */
+#include "v4/node.h"
+
+void v4_node_reset(v4_node *n)
+{
+    n->p = 0;
+    n->a = 0;
+    n->b = 0;
+    for (unsigned i = 0; i < V4_NODE_WORDS; i++) n->mem[i] = 0;
+    v4_guard_fill(n->mem_guard_head, V4_MEM_BOUND, V4_GUARD_PATTERN_HEAD);
+    v4_guard_fill(n->mem_guard_tail, V4_MEM_BOUND, V4_GUARD_PATTERN_TAIL);
+    v4_dstack_reset(&n->ds);
+    v4_rstack_reset(&n->rs);
+}
+
+int v4_node_guards_intact(const v4_node *n)
+{
+    return v4_guard_intact(n->mem_guard_head, V4_MEM_BOUND, V4_GUARD_PATTERN_HEAD)
+        && v4_guard_intact(n->mem_guard_tail, V4_MEM_BOUND, V4_GUARD_PATTERN_TAIL)
+        && v4_dstack_guards_intact(&n->ds)
+        && v4_rstack_guards_intact(&n->rs);
+}
+
+v4_cell v4_node_load(const v4_node *n, v4_cell addr)
+{
+    /* Precondition checked by the caller; see node.h.  The unsigned compare is
+     * deliberate: `addr` is signed, and a negative address must not wrap into
+     * a large positive one and read the top of memory instead. */
+    return n->mem[(unsigned)addr];
+}
+
+void v4_node_store(v4_node *n, v4_cell addr, v4_cell value)
+{
+    n->mem[(unsigned)addr] = value;
+}