feat(v4.0.0): the system boots from a nucleus and loads its capsules

One boot, v4/system/boot.c, for both products: it starts the nucleus image,
finds each capsule in the baked capsule directory, recomputes its hash,
checks its signature, gives its blocks to the node a line at a time, and
prints PARITY:V4_NUCLEUS, PARITY:V4_CAPSULE and PARITY:OK before the prompt.
A line the node does not accept ends the boot with the capsule, block and
line named.  docs/v4.0.0/NUCLEUS.md.

- hosted Linux product for amd64, aarch64 and riscv64 (make -C v4 hosted);
  make -C v4 hosted-check boots all three and requires identical output
- the kernel's v4 entry (STARFORTH_V4=1) calls the same boot
- capsules/v4/forth79.4th, block 6000: no definitions yet
- mkimage builds the nucleus only; no FORTH source is compiled at build time
- capsule_blocks.c: the Block-header parse, free of any VM, for every loader

Verified: make -C v4 test passes; hosted-check passes on the three ISAs with
the same hashes; the kernel compiles with STARFORTH_V4=1 on the three.
Not verified: no bare-metal boot of v4 has been run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/src/heat.c

@@ -1,12 +1,14 @@
 /* heat.c -- heat and anti-clock.  See heat.h. */
 #include "v4/heat.h"
-#include <string.h>
 
 void v4_heat_reset(v4_heat *h)
 {
-    memset(h->op, 0, sizeof(h->op));
-    memset(h->call, 0, sizeof(h->call));
-    memset(h->call_freeze_mask, 0, sizeof(h->call_freeze_mask));
+    /* Loops, not memset: the engine uses nothing from the C library, so that
+     * the bare-metal kernel can link it as it is. */
+    unsigned i;
+    for (i = 0; i < sizeof h->op / sizeof h->op[0]; i++) h->op[i] = 0;
+    for (i = 0; i < sizeof h->call / sizeof h->call[0]; i++) h->call[i] = 0;
+    for (i = 0; i < sizeof h->call_freeze_mask / sizeof h->call_freeze_mask[0]; i++) h->call_freeze_mask[i] = 0;
 }
 
 void v4_heat_on_retire(v4_heat *h, unsigned op, v4_uheat_t *anticlock)

v4/src/image.c

@@ -0,0 +1,36 @@
+/* image.c -- start a node from a capsule image.  See image.h.
+ *
+ * Nothing here uses the C library: the bare-metal kernel links this file.
+ */
+#include "v4/image.h"
+
+int v4_image_boot(v4_node *n, v4_exec_state *es, v4_heat *h, const v4_image *im,
+                  unsigned char *disk, unsigned blocks)
+{
+    unsigned i;
+
+    if (im->cell_bits != (unsigned)V4_CELL_BITS || im->node_words != (unsigned)V4_NODE_WORDS
+        || im->data_ring != (unsigned)V4_DATA_RING || im->ret_ring != (unsigned)V4_RET_RING)
+        return 0;
+
+    v4_node_reset(n);
+    v4_exec_reset(es);
+    v4_heat_reset(h);
+    for (i = 0; i < im->count; i++)
+        if (v4_node_addr_ok(im->cells[i].addr)) n->mem[im->cells[i].addr] = im->cells[i].value;
+
+    v4_node_console_attach(n, im->console_tx);
+    v4_node_console_input_attach(n, im->console_rx, im->console_status);
+    v4_node_stack_regs_attach(n, im->dstack_reg, im->rstack_reg);
+    v4_node_error_attach(n, im->node_error);
+    v4_node_fault_attach(n, im->fault_table);
+    if (disk && blocks) v4_node_storage_attach(n, im->storage_reg, disk, blocks);
+
+    n->p = im->entry;
+    return 1;
+}
+
+int v4_image_waiting(const v4_node *n, const v4_image *im)
+{
+    return n->input_pos == n->input_len && n->p >= im->key_start && n->p < im->key_end;
+}