feat(log): LOG-FLUSH -- a VM's log records reach Artemis's log ring; and the ring keeps its order when it grows

FABRIC-3 SXXXII.4's deferred LOG-FLUSH, built to the 2026-10-14 rulings
(SXXXVIII): everything a VM logs, at or above the log level, goes into its
own buffer; it goes to Artemis on LOG-FLUSH, when full, and at once on an
ERROR, as one kernel-Hermes LOG_BATCH message she writes on her own turn,
the source being the sender the kernel stamped.  Records that cannot go yet
are counted and reported with the next flush.  LOG-SHOW (Hera only) reads
the ring back -- it had no reader.

Found by the first test that filled it: ring growth overwrote the oldest
record and put blank slots inside the live range.  Fixed test first.

Three ISAs: POST 1052 passed; new parity baseline word_count=526
hash=0x82f4ae7cb2e2d424 (deliberate).  CLAUDE.md: Phase 8 PKI closed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/include/starkernel/log_region.h

@@ -182,6 +182,16 @@ int log_region_append(uint8_t level, uint64_t timestamp,
                        const char *source, uint32_t source_len,
                        const char *msg, uint32_t msg_len);
 
+/**
+ * log_region_read_recent - read one record back (2026-10-14, for LOG-SHOW).
+ *
+ * @param back 0 for the newest record, 1 for the one before it, ...
+ * @param out  Filled with the record.
+ * @return 0 on success, 1 if there is no such record (the ring holds fewer
+ *         than back+1, or none at all), -1 on a read failure or no ring.
+ */
+int log_region_read_recent(uint32_t back, log_slot_t *out);
+
 #ifdef __cplusplus
 }
 #endif