feat(v4.0.0): the nucleus is a capsule, sent to a node born empty

MESH.md step 2.  A capsule of F18 code is the words a neighbour writes to a
node's port: for each stretch of memory, "@p a! @p push", the address and
count, "@p !+ unext" and the words; then a jump to the start.  A node born
empty executes that from its port, so it needs nothing in it beforehand.

- capsule.h/.c: v4_capsule_write, any node's memory as such a capsule
- mkimage writes the nucleus so, to capsules/v4/nucleus-64.f18, and the
  addresses a host needs as a C file; the memory image is no longer linked
  into either product
- mkcapsule is unchanged: the nucleus capsule is a built file kept under
  capsules/, as BLOCK_MAP.md is, and is baked, hashed and signed with the
  rest
- boot: the node is born empty (v4_image_born); the nucleus capsule is
  found, its hash and signature checked, and given to the node a word at a
  time as it reads its port; PARITY:V4_NUCLEUS carries its name and hash

Verified: test_fabric.c (59 checks, both widths, and under ASan and UBSan):
a memory with a programme and scattered words arrives word for word in an
empty node and runs.  The nucleus capsule rebuilds byte for byte.
hosted-check passes on three ISAs; clean qemu with STARFORTH_V4=1 on amd64,
aarch64 and riscv64 takes the nucleus in, passes POST (550 of 550) and
answers lines typed at each prompt (logs/20261006-102421, -102706,
-103048).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/Makefile

@@ -613,7 +613,7 @@ V4_DEFS := -DSTARFORTH_V4=1 -Iv4/include \
 KERNEL_CFLAGS += $(V4_DEFS)
 LOADER_CFLAGS += $(V4_DEFS)
 
-V4_ENGINE_SRCS := $(addprefix v4/src/,node.c exec.c stack.c iword.c heat.c guard.c image.c fabric.c)
+V4_ENGINE_SRCS := $(addprefix v4/src/,node.c exec.c stack.c iword.c heat.c guard.c image.c fabric.c capsule.c)
 V4_IMAGE_C     := $(BUILD_DIR)/v4_image_64.c
 
 LOADER_EXTRA_SRCS += $(KERNEL_SRC)/v4/sk_v4.c
@@ -765,6 +765,9 @@ endif
 # StarForth v4: the capsule image, built on this machine by v4's Makefile, and
 # the engine, compiled like any other kernel source.
 ifeq ($(STARFORTH_V4),1)
+# The nucleus is a capsule (capsules/v4/nucleus-64.f18), written by the same
+# step that writes its description, so the capsule directory waits for it.
+$(CAPSULE_GENERATED): $(V4_IMAGE_C)
 $(V4_IMAGE_C): FORCE
 	@mkdir -p $(dir $@)
 	@echo "  V4IMG   v4/capsule -> $@"