fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/include/starkernel/log_region.h

@@ -31,7 +31,7 @@
  * only artifact both platforms share is whatever got persisted to disk.
  *
  * Lives in the SAME top-of-device system-metadata fence artemis_sig_t and
- * Zuse's genesis marker/eligibility list already use
+ * Zuse's genesis marker already uses
  * (block_subsystem.h's blk_meta_zone_read()/write(), devblock_from_top
  * addressing) -- reached the SAME way, deliberately NOT through
  * artemis_sig.c's own independent blkio_info()-based arithmetic. That
@@ -52,11 +52,9 @@
  *   64       -- artemis_sig_t itself (ARTEMIS_SIG_DEVBLOCK_FROM_TOP)
  *   65       -- this ring's control header (LOG_REGION_DEVBLOCK_FROM_TOP_BASE)
  *   66-96    -- this ring's slot devblocks, growable up to LOG_REGION_MAX_DEVBLOCKS
- * Chosen clear of Zuse's genesis marker (devblock_from_top=0) and
- * eligibility list (chains upward from 1, unbounded in code -- see
- * zuse_eligibility_list.h's own CORRECTION comment, updated alongside this
- * file, for the honest real-world headroom that leaves: devblocks 1-63,
- * ~8000 possible eligible identities before ever reaching 64).
+ * Chosen clear of Zuse's genesis marker (devblock_from_top=0) and of
+ * devblocks 1-63, reserved and unused since Zuse's eligibility list was
+ * removed (2026-10-14, FABRIC-3.md SXXXVII).
  *
  * Ring granularity is one whole devblock-quarter (LOG_SLOT_SIZE, 1024
  * bytes = exactly one blkio forth-block) per record -- avoids any