Stage 4 increments 2+3: WIREBIND VMs as switch-signal participants + mark-and-defer tombstone reap (FABRIC-3.md §XXVIII Stage 4)

Increment 2: WIREBIND user VMs (the ones that actually run FORTH work;
console VMs are pure REPL proxies and never participate) register as
Stage 3 switch-signal participants at attach, unregister at teardown.
Slot table bumped 8 -> 16, matching messaging.4th's own VM-MAX -- a real,
already-agreed ceiling, not an invented number. Added
sk_vm_switch_signal_unregister() (compaction-based; Tripod VMs never
needed removal, WIREBIND VMs cycle constantly and would otherwise
exhaust the bounded table).

Increment 3: implements the plan's own ratified option (A) for the
async-detach UAF risk -- mark-and-defer via a new pending_reap flag on
VMRegistryEntry, deliberately not a new VMState (capsule_vm_kill()
already treats VM_STATE_DEAD as idempotent success, which would silently
swallow a reap attempt; SWITCHED_OUT still accurately describes a
tombstoned VM until the moment it's actually freed). unclean_detach()
sets it when capsule_vm_kill() refuses a SWITCHED_OUT target; the Stage 3
checkpoint (vm_core.c) checks it before ever attempting to resume a
pending switch target, and calls the new capsule_vm_force_reap() instead
-- the one caller allowed to bypass capsule_vm_kill()'s own refusal,
because it runs at the exact safe cooperative point the switcher itself
controls. A new idle-tick sweep cleans up the WIREBIND live-table entry
once the reap has actually happened.

Verified clean on all 3 architectures (baseline regression -- no
WIREBIND attach happens in a plain boot). The reap mechanism's own
correctness under a genuinely parked context is verified separately,
next, via a temporary deterministic probe.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

include/starkernel/capsule_vm_switch_signal.h

@@ -65,6 +65,17 @@
  * critical-section protection against being switched away mid-setup). */
 int sk_vm_switch_signal_register(VMUuid vm_id);
 
+/* Remove a switch-signal participant (FABRIC-3.md §XXVIII Stage 4,
+ * 2026-09-14) -- Tripod VMs never need this (they live forever), but
+ * WIREBIND-birthed identity VMs cycle through attach/detach repeatedly
+ * and must free their slot for reuse, or the bounded table exhausts
+ * after SK_SWITCH_MAX_SLOTS attach/detach cycles. Compacts the table
+ * (small, bounded, mutated only at attach/detach -- not a hot path).
+ * Clears a pending switch targeting this VM, if any, so the checkpoint
+ * never attempts to switch into a no-longer-registered participant.
+ * No-op (returns -1) if vm_id was never registered. */
+int sk_vm_switch_signal_unregister(VMUuid vm_id);
+
 /* Called from heartbeat_tick() (ISR context) every timer tick. Cheap:
  * iterates only the registered slots (bounded, small). */
 void sk_vm_switch_signal_tick(void);