feat(v4.0.0): the node tells its kernel of its words; the boot seals the system

ENGINE.md 3b, the node's side of ruling A (a word's code is the node's, its
accounts the kernel's).

- dict.v4, system.v4: (WORD-DEFINED) ( xt -- ) is run when an entry is
  made, (WORD-FORGOTTEN) ( w -- ) when FORGET or COLD removes entries; with
  0 there no one is told, as on the hosted product
- test_host_quit.c: a kernel that keeps the list of words and is checked to
  hold exactly the node's dictionary after definitions, a vocabulary, an
  abandoned definition, FORGET, a refused FORGET and COLD; KERNEL-WORD
  called from the prompt and from a definition

Fixed, found while writing that test: since the capsules moved from build
time to boot time (294e6946), what COLD returns to and FORGET protects was
still the nucleus alone, so COLD lost U*, U/MOD and BYE and FORGET U* was
allowed.  The boot now seals the system when it has loaded it
(v4_image_seal), and hosted-check checks COLD, the capsule word after it,
the refused FORGET and BYE.

Verified: make -C v4 test passes at both widths (1283 checks in
test_host_quit.c); hosted-check passes on three ISAs; clean qemu with
STARFORTH_V4=1 on amd64, aarch64 and riscv64 passes POST, and COLD, U*
after it, FORGET U* (refused), an unserved kernel word and BYE typed at
each prompt are answered correctly (logs/20261005-193045, -193307, -193636).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/include/v4/image.h

@@ -57,11 +57,22 @@ typedef struct {
      * LATEST the newest word of FORTH.  What lies below HERE, and LATEST,
      * is what the dictionary hash covers (v4/include/v4/boot.h). */
     v4_cell dp, latest;
+
+    /* What COLD returns the system to and FORGET will not go below: two
+     * cells, DP and LATEST as they were when the system was complete, and
+     * the variable FENCE.  The image has them as the nucleus alone; a system
+     * that loads capsules when it boots sets them again when it has
+     * (v4_image_seal). */
+    v4_cell boot_cells, fence;
 } v4_image;
 
 /* The image built from v4/capsule (the generated file defines it). */
 extern const v4_image v4_capsule_image;
 
+/* The system is complete: what is in the dictionary now is what COLD comes
+ * back to, and FORGET will not go below it. */
+void v4_image_seal(v4_node *n, const v4_image *im);
+
 /* How a line ended. */
 #define V4_LINE_QUIT      0              /* QUIT: nothing is to be said */
 #define V4_LINE_COMPLETED 1              /* the host says " ok" */