Stage 4 increments 2+3: WIREBIND VMs as switch-signal participants + mark-and-defer tombstone reap (FABRIC-3.md §XXVIII Stage 4)

Increment 2: WIREBIND user VMs (the ones that actually run FORTH work;
console VMs are pure REPL proxies and never participate) register as
Stage 3 switch-signal participants at attach, unregister at teardown.
Slot table bumped 8 -> 16, matching messaging.4th's own VM-MAX -- a real,
already-agreed ceiling, not an invented number. Added
sk_vm_switch_signal_unregister() (compaction-based; Tripod VMs never
needed removal, WIREBIND VMs cycle constantly and would otherwise
exhaust the bounded table).

Increment 3: implements the plan's own ratified option (A) for the
async-detach UAF risk -- mark-and-defer via a new pending_reap flag on
VMRegistryEntry, deliberately not a new VMState (capsule_vm_kill()
already treats VM_STATE_DEAD as idempotent success, which would silently
swallow a reap attempt; SWITCHED_OUT still accurately describes a
tombstoned VM until the moment it's actually freed). unclean_detach()
sets it when capsule_vm_kill() refuses a SWITCHED_OUT target; the Stage 3
checkpoint (vm_core.c) checks it before ever attempting to resume a
pending switch target, and calls the new capsule_vm_force_reap() instead
-- the one caller allowed to bypass capsule_vm_kill()'s own refusal,
because it runs at the exact safe cooperative point the switcher itself
controls. A new idle-tick sweep cleans up the WIREBIND live-table entry
once the reap has actually happened.

Verified clean on all 3 architectures (baseline regression -- no
WIREBIND attach happens in a plain boot). The reap mechanism's own
correctness under a genuinely parked context is verified separately,
next, via a temporary deterministic probe.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

src/starkernel/capsule/capsule_birth.c

@@ -37,6 +37,7 @@
 #include "starkernel/vm/arena.h" /* FABRIC-3.md §XXVIII Stage 1 -- sk_vm_native_stack_alloc() */
 #include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-2.md §H.12 step 5 */
 #include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-2.md §I.5 CONTRIB trust tier */
+#include "starkernel/capsule_vm_switch_signal.h" /* FABRIC-3.md §XXVIII Stage 4 -- capsule_vm_force_reap() */
 #include "vm.h"
 #include "platform_alloc.h"
 /* No LOG_LINE_MAX include-order constraint anymore: vm.h's own
@@ -323,6 +324,62 @@ void capsule_vm_set_state(VMUuid vm_id, uint32_t state) {
     if (entry) entry->state = state;
 }
 
+void capsule_vm_set_pending_reap(VMUuid vm_id, int pending) {
+    VMRegistryEntry *entry = vm_find_entry_ptr(vm_id);
+    if (entry) entry->pending_reap = pending;
+}
+
+void capsule_vm_force_reap(VMUuid vm_id) {
+    VMRegistryEntry *entry = vm_find_entry_ptr(vm_id);
+    if (!entry) return;
+
+    /* Idempotent, matching capsule_vm_kill()'s own convention -- the
+     * Stage 3 checkpoint that calls this cannot itself know whether some
+     * other path (a later re-attach's own teardown, say) already reaped
+     * this exact VM before the checkpoint got to it. */
+    if (entry->state == VM_STATE_DEAD) return;
+
+    /* Hera is never a switch-signal participant subject to pending_reap
+     * in the first place, but refuse on principle anyway -- matches
+     * capsule_vm_kill()'s own unconditional rule. */
+    if (vm_uuid_is_hera(entry->vm_id)) return;
+
+    VM *vm = (VM *)entry->vm_ptr;
+
+    /* Deliberately NOT capsule_vm_kill()'s VM_STATE_SWITCHED_OUT refusal
+     * -- that guard exists precisely for the case this function handles:
+     * the caller (vm_core.c's Stage 3 checkpoint) has already decided,
+     * at a safe cooperative point it alone controls, that this parked
+     * native-stack context will never be resumed. Freeing it here is the
+     * deferred half of the mark-and-defer design (FABRIC-3.md §XXVIII
+     * Stage 4) -- see VMRegistryEntry.pending_reap's own doc comment. */
+    if (entry->stadium_patron_cell != STADIUM_CELL_NONE) {
+        (void)stadium_evict(entry->stadium_patron_cell);
+        entry->stadium_patron_cell = STADIUM_CELL_NONE;
+    }
+
+    if (vm) {
+        vm_cleanup(vm);
+        sf_free(vm);
+    }
+
+    /* Generic cleanup, independent of whatever subsystem set
+     * pending_reap -- a reaped VM is no longer a switch-signal
+     * participant either way. */
+    sk_vm_switch_signal_unregister(vm_id);
+
+    capsule_parity_log_kill(vm_id, entry->name);
+
+    console_puts("REAP: ");
+    console_puts(entry->name[0] ? entry->name : "(unnamed)");
+    console_println(" tombstone reclaimed");
+
+    entry->vm_ptr        = (void *)0;
+    entry->state         = VM_STATE_DEAD;
+    entry->pending_reap  = 0;
+    for (uint32_t i = 0; i < VM_NAME_MAX; i++) entry->name[i] = '\0';
+}
+
 void capsule_vm_registry_set_name(VMUuid vm_id, const char *name) {
     VMRegistryEntry *entry;
     if (!name) return;