feat(v4.0.0): the system boots from a nucleus and loads its capsules

One boot, v4/system/boot.c, for both products: it starts the nucleus image,
finds each capsule in the baked capsule directory, recomputes its hash,
checks its signature, gives its blocks to the node a line at a time, and
prints PARITY:V4_NUCLEUS, PARITY:V4_CAPSULE and PARITY:OK before the prompt.
A line the node does not accept ends the boot with the capsule, block and
line named.  docs/v4.0.0/NUCLEUS.md.

- hosted Linux product for amd64, aarch64 and riscv64 (make -C v4 hosted);
  make -C v4 hosted-check boots all three and requires identical output
- the kernel's v4 entry (STARFORTH_V4=1) calls the same boot
- capsules/v4/forth79.4th, block 6000: no definitions yet
- mkimage builds the nucleus only; no FORTH source is compiled at build time
- capsule_blocks.c: the Block-header parse, free of any VM, for every loader

Verified: make -C v4 test passes; hosted-check passes on the three ISAs with
the same hashes; the kernel compiles with STARFORTH_V4=1 on the three.
Not verified: no bare-metal boot of v4 has been run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/src/heat.c

@@ -1,12 +1,14 @@
 /* heat.c -- heat and anti-clock.  See heat.h. */
 #include "v4/heat.h"
-#include <string.h>
 
 void v4_heat_reset(v4_heat *h)
 {
-    memset(h->op, 0, sizeof(h->op));
-    memset(h->call, 0, sizeof(h->call));
-    memset(h->call_freeze_mask, 0, sizeof(h->call_freeze_mask));
+    /* Loops, not memset: the engine uses nothing from the C library, so that
+     * the bare-metal kernel can link it as it is. */
+    unsigned i;
+    for (i = 0; i < sizeof h->op / sizeof h->op[0]; i++) h->op[i] = 0;
+    for (i = 0; i < sizeof h->call / sizeof h->call[0]; i++) h->call[i] = 0;
+    for (i = 0; i < sizeof h->call_freeze_mask / sizeof h->call_freeze_mask[0]; i++) h->call_freeze_mask[i] = 0;
 }
 
 void v4_heat_on_retire(v4_heat *h, unsigned op, v4_uheat_t *anticlock)