Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

FABRIC.md -> FABRIC-0.md
FABRIC-2.md -> FABRIC-1.md
FABRIC-3.md -> FABRIC-2.md (the current/living document)
FABRIC-4.md unchanged (new #3 to follow separately)

Every cross-reference repo-wide updated to match, including doc-comment
citations inside kernel source (.c/.h) files -- done via an ordered
placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md->
placeholder1, FABRIC.md->placeholder0, then placeholders resolved to
final names) in a single pass per file to avoid double-shifting
already-renamed references.

One line in capsules/font.4th grew past the 64-char block-format limit
as a side effect of the longer filename; shortened it and reverified
with mkcapsule --lint (34/34 pass) before rebuilding.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after the fix; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

src/starkernel/capsule/capsule_birth.c

@@ -34,8 +34,8 @@
 #include "starkernel/kmalloc.h"
 #include "starkernel/console.h"
 #include "starkernel/vm/stadium.h" /* item 4.1a -- stadium_grant_quota() */
-#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-3.md §H.12 step 5 */
-#include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-3.md §I.5 CONTRIB trust tier */
+#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-2.md §H.12 step 5 */
+#include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-2.md §I.5 CONTRIB trust tier */
 #include "vm.h"
 #include "platform_alloc.h"
 /* No LOG_LINE_MAX include-order constraint anymore: vm.h's own
@@ -105,7 +105,7 @@ static VMRegistryEntry *vm_find_entry_ptr(VMUuid vm_id) {
     return (void *)0;
 }
 
-/* FABRIC-3.md §H.12 step 10: creator-ceiling enforcement, birth-time
+/* FABRIC-2.md §H.12 step 10: creator-ceiling enforcement, birth-time
  * snapshot only, no live sync (§H.3, decided 2026-09-03 -- "if something
  * was developed with a particular set of ACLs, it should remain at
  * that... otherwise parent changes break the child's program"). For
@@ -244,7 +244,7 @@ int capsule_vm_registry_get_by_index(uint32_t index, VMRegistryEntry *out) {
 /* Live population, distinct from vm_registry_count above: vm_registry_count
  * is monotonic (incremented on every vm_registry_alloc(), never decremented
  * on death), so it counts every VM ever born, not the outer Stadium's
- * current occupancy. FABRIC.md item 1.5's bound is on LIVE VMs -- a dead or
+ * current occupancy. FABRIC-0.md item 1.5's bound is on LIVE VMs -- a dead or
  * stillborn slot doesn't hold Stadium capacity, and gating on the monotonic
  * total would mean the fleet could never regrow after any VM's death,
  * which contradicts Hera's own kill-then-rebirth lifecycle (TRIPOD-TEST's
@@ -394,7 +394,7 @@ int capsule_vm_kill(const char *name) {
     vm_id = entry->vm_id;
     vm    = (VM *)entry->vm_ptr;
 
-    /* FABRIC-3.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
+    /* FABRIC-2.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
      * real, dispatching COOL. Refusal (already naturally reclaimed by
      * unrelated quota pressure, or never admitted) is silently tolerated --
      * KILL tears the VM down unconditionally either way. */
@@ -451,7 +451,7 @@ void capsule_vm_kill_all_nonmama(void) {
     }
 }
 
-/* FABRIC-3.md §I.5, 2026-09-04: contributor-capsule trust tier
+/* FABRIC-2.md §I.5, 2026-09-04: contributor-capsule trust tier
  * (QEMU-vs-real-hardware conditional enforcement, decided in
  * conversation). CAPSULE_FLAG_CONTRIB capsules get the same WARN-only
  * treatment as everything else under QEMU (timer_calibration_record()->
@@ -574,7 +574,7 @@ CapsuleRunResult capsule_birth_baby(
     /* Milestone 6 (Phase 8): enforced only on INVALID -- see the fuller
      * comment in capsule_birth_mama() above for why MISSING/NO_ROOT_KEY
      * stay WARN-only. Skipped entirely when skip_pki_sig is set (RUNCAP,
-     * FABRIC-3.md §F.6/F.18): capsule_get_signatures() is the compile-
+     * FABRIC-2.md §F.6/F.18): capsule_get_signatures() is the compile-
      * time-baked array, indexed against the build-time capsule_descriptors[]
      * -- meaningless for a heap-built directory sourced from a thumbdrive,
      * where idx 0 would just compare against whatever real capsule happens
@@ -589,7 +589,7 @@ CapsuleRunResult capsule_birth_baby(
                         names[idx].name, capsule_sig_result_str(sr));
             if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
         }
-        /* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
+        /* FABRIC-2.md §I.5: contrib trust tier -- see contrib_capsule_
          * refused()'s own doc comment. */
         if (contrib_capsule_refused(cap->flags, sr)) {
             log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",
@@ -627,7 +627,7 @@ CapsuleRunResult capsule_birth_baby(
      * own reservoir, not vm_uuid_hera()'s (item 4.1's hardcoded default). */
     ((VM *)new_vm)->stadium_vm_id = vm_id;
 
-    /* item 4.6 fix (FABRIC-2.md, 2026-08-18): granted here, before IDENTITY
+    /* item 4.6 fix (FABRIC-1.md, 2026-08-18): granted here, before IDENTITY
      * exec, not after a confirmed live birth as item 4.1a originally placed
      * it. item 4.1a's placement assumed no VM's own IDENTITY code would ever
      * need a Stadium quota before birth completes -- true until item 4.6's
@@ -641,7 +641,7 @@ CapsuleRunResult capsule_birth_baby(
      * stillbirth here is the rare case, not the common one. */
     (void)stadium_grant_quota(vm_id, vm_uuid_hera());
 
-    /* FABRIC-3.md SS B, VM-COOL: admit this VM as a patron of its own
+    /* FABRIC-2.md SS B, VM-COOL: admit this VM as a patron of its own
      * quota -- identity 0 (same convention stadium_birth_hera() uses for
      * "patron zero"), heat 0 (no reservoir cost). Admitted unpinned here
      * regardless of which VM this is -- pinning (when it applies) happens
@@ -650,7 +650,7 @@ CapsuleRunResult capsule_birth_baby(
      * Hera (stadium_admit() has no admission-time-special pin handling,
      * just copies the candidate header, so this ordering is safe).
      *
-     * FABRIC-3.md §H.12 step 5: fleet-foundation VMs (Hera/Hermes/Artemis)
+     * FABRIC-2.md §H.12 step 5: fleet-foundation VMs (Hera/Hermes/Artemis)
      * are pinned -- permanent, exempt from COOL, per §H.1's decision.
      * Ordinary/user VMs stay unpinned, matching the original comment's own
      * reasoning here (unrelated quota pressure can naturally evict this
@@ -786,7 +786,7 @@ CapsuleRunResult capsule_run_experiment(
                         names[idx].name, capsule_sig_result_str(sr));
             if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
         }
-        /* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
+        /* FABRIC-2.md §I.5: contrib trust tier -- see contrib_capsule_
          * refused()'s own doc comment. */
         if (contrib_capsule_refused(cap->flags, sr)) {
             log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",