Stage 1: per-VM native stacks, allocated but not yet executed on (FABRIC-3.md §XXVIII)

Second stage of the preemptive context-switching plan. Every VM (Hera,
every capsule_birth_baby()-born VM including WIREBIND identities) now
gets its own dedicated 2 MiB native C stack at birth -- but nothing runs
on it yet, that's Stage 2. Pure allocation-machinery proof.

Design correction made before writing code: the plan called for cloning
sk_vm_arena_alloc()'s guard-page pattern, but that pattern turns out to
be Mama-only -- host_services.c's kernel_alloc() gives every baby VM a
plain kmalloc() block for its dictionary arena, not a real guarded PMM
allocation. Stacks get the real treatment instead (new
sk_vm_native_stack_alloc()/_free() in arena.c): independent
pmm_alloc_contiguous() + guard pages for every VM without exception, no
singleton, no kmalloc fallback -- a stack overflow is exactly the
failure mode guard pages exist for, and a corrupted stack could corrupt
whatever saved context Stage 2 trusts.

2 MiB size matches this project's own established kernel-stack
convention (g_kernel_stack/g_rpi5_native_stack), not a guess -- that one
shared 2 MiB stack today already carries all VMs' combined nested
VM-EXEC recursion.

Three new VM struct fields, freed in vm_cleanup() alongside the existing
call_stack free. Allocation failure is non-fatal to birth.

All 3 architectures re-verified clean boot to ok>, no native-stack
allocation failures for any Tripod-fleet VM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016UNhH1mhi52i6Qihh7ZV5S

src/starkernel/capsule/capsule_birth.c

@@ -34,6 +34,7 @@
 #include "starkernel/kmalloc.h"
 #include "starkernel/console.h"
 #include "starkernel/vm/stadium.h" /* item 4.1a -- stadium_grant_quota() */
+#include "starkernel/vm/arena.h" /* FABRIC-3.md §XXVIII Stage 1 -- sk_vm_native_stack_alloc() */
 #include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-2.md §H.12 step 5 */
 #include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-2.md §I.5 CONTRIB trust tier */
 #include "vm.h"
@@ -627,6 +628,26 @@ CapsuleRunResult capsule_birth_baby(
      * own reservoir, not vm_uuid_hera()'s (item 4.1's hardcoded default). */
     ((VM *)new_vm)->stadium_vm_id = vm_id;
 
+    /* FABRIC-3.md §XXVIII, Stage 1 (2026-09-13): every VM gets its own
+     * native stack from the moment it exists, including WIREBIND-birthed
+     * identity VMs -- purely additive here, nothing executes on it yet
+     * (that's Stage 2). Allocation failure is not fatal to birth itself:
+     * a VM with no native stack yet is exactly as functional today as
+     * every VM has always been (nothing currently runs on a dedicated
+     * per-VM stack), so this degrades to "not yet switchable," not
+     * "stillborn." native_stack_top stays 0, the pre-Stage-2 default. */
+    {
+        sk_vm_native_stack_t ns;
+        if (sk_vm_native_stack_alloc(&ns) == 0) {
+            ((VM *)new_vm)->native_stack_paddr       = ns.paddr;
+            ((VM *)new_vm)->native_stack_guard_vaddr = ns.guard_vaddr;
+            ((VM *)new_vm)->native_stack_top         = ns.stack_top;
+        } else {
+            log_message(LOG_WARN, "capsule_birth_baby: native stack allocation failed for %s",
+                        capsule_name);
+        }
+    }
+
     /* item 4.6 fix (FABRIC-1.md, 2026-08-18): granted here, before IDENTITY
      * exec, not after a confirmed live birth as item 4.1a originally placed
      * it. item 4.1a's placement assumed no VM's own IDENTITY code would ever