feat(v4.0.0): word-level access control at the prompt, as v3

- Each entry's flags cell also holds v3's four fields: denied, pinned,
  mode and a 16-bit TTL.
- compile.v4: INTERPRET checks every word it is about to execute or
  compile -- recheck at TTL 0, else count down; a denied word is refused
  with v3's line, the stack emptied and the line ended.
- capsule/acl.v4: ACL-MODE@ ACL-MODE! ACL-TTL@ ACL-TTL! ACL-ALLOW@
  ACL-ALLOW! ACL-PINNED? ACL-PIN ACL-INHERIT ACL-INIT-PRIMITIVES ACL-HEAT@
  ACL-WORD-ID, and ACL-HOOK.
- capsule/ACL.fth: v3's ACL.4th as FORTH source the node compiles; loading
  it switches access control on.
- v3 checks every execution, inside definitions too.  v4's code is native,
  so it checks a word when it is compiled as well as when interpreted; a
  call compiled while the word was allowed is not checked again.
  DECOMPOSITION.md 5.20 says so.
- ACL-HEAT@ is 0 until heat is readable (D-6).
- tests/test_host_quit.c: seven transcripts of the v3 binary; the policy
  file loaded and exercised; COLD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/capsule/compile.v4

@@ -99,6 +99,47 @@ macro ROT   push SWAP pop SWAP   endmacro
   dup -3 + a! @ 8 and if CALL  drop jump (INLINE,)
   CALL: drop jump (CALL,)
 
+\ ---- access control (5.20) -------------------------------------------------------
+\ Each entry's flags cell also holds its access control fields:
+\   bit 5 (32)      denied: the word may not be used
+\   bit 6 (64)      pinned: the fields cannot be changed
+\   bits 8 .. 15    the mode: 0 TTL, 1 STRICT
+\   bits 16 .. 31   the TTL, a count of uses left before the next recheck
+\ A new entry has all of them zero: allowed, not pinned, TTL mode, TTL 0.
+\
+\ (ACL?) is run by INTERPRET for every word it is about to execute or
+\ compile.  As v3: if the TTL is 0 the word is rechecked, otherwise the TTL
+\ is counted down; then a denied word is refused.  The recheck is the word
+\ whose address is in (ACL-HOOK) -- ACL-RECHECK, once ACL.fth has loaded --
+\ and with none there the word is allowed and given the longest TTL.
+\
+\ v3 checks every execution, inside definitions too.  v4 code is native: a
+\ compiled call goes straight to its word.  So v4 checks a word when it is
+\ compiled as well as when it is interpreted -- a denied word cannot be
+\ built into anything new -- but a call compiled while the word was allowed
+\ is not checked again.
+
+\ ( xt -- )   recheck
+: (ACL-RECHECK)
+  (ACL-HOOK) a! @ if NONE  push ex           \ call it with the xt
+  ;
+  NONE: drop  -3 + a! @  65535 and -33 and  $FFFF0000 + ! ;
+
+\ ( xt -- xt )   as above; a denied word ends the line
+: (ACL?)
+  dup -3 + a! @                              \ xt flags
+  dup $FFFF0000 and if ZERO
+    drop  -65536 + !  jump TEST              \ one use fewer
+  ZERO: drop drop  dup (ACL-RECHECK)
+  TEST: dup -3 + a! @ 32 and if OK
+  drop drop
+  $33335B1B (EMIT4) $6D (EMIT4)  $4E524157 (EMIT4) $203A (EMIT4)  $6D305B1B (EMIT4)                 \ v3's line: WARN: in yellow
+  $3A4C4341 (EMIT4) $6E656420 (EMIT4) $20646569 (EMIT4) $27 (EMIT4)
+  (.WORD)  39 EMIT CR
+  DSTACK-DEPTH b! a !b                       \ as v3, the stack is emptied
+  pop drop  jump (ABANDON)
+  OK: drop ;
+
 \ ( -- )   print the word WORD has just left
 : (.WORD)   WBUF COUNT jump TYPE
 
@@ -147,13 +188,13 @@ header INTERPRET
      dup -3 + a! @                           \ xt flags
      STATE a! @ if INTERP
        drop  1 and if COMP                   \ compiling: immediate words still run
-       drop EXECUTE  jump L
-       COMP: drop (COMPILE,)  jump L
+       drop (ACL?) EXECUTE  jump L
+       COMP: drop (ACL?) (COMPILE,)  jump L
      INTERP: drop  16 and if RUN
        drop drop  (.WORD)                    \ ": compile-only"
        $6F63203A (EMIT4) $6C69706D (EMIT4) $6E6F2D65 (EMIT4) $796C (EMIT4) CR
        jump (ABANDON)
-       RUN: drop EXECUTE  jump L
+       RUN: drop (ACL?) EXECUTE  jump L
   NUM: drop  (NUM?) if BAD
        drop
        STATE a! @ if KEEP  drop (LIT,)  jump L