fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/src/vm/kernel_hermes.c

@@ -656,26 +656,13 @@ int sk_hermes_drain_checkpoint(VM *vm) {
         console_println(line);
     }
 
-    /* FABRIC-3.6.md task 3.10 evidence: ELEVATE-REQUEST also has no fixed
-     * C-side handler word -- its payload is a FORTH command string
-     * calling ELEVATE-GRANT (zuse-eligibility.4th), interpreted as-is
-     * below, same shape as CONSOLE-CMD-EVENT above. Same mid-hold-instant
-     * evidence, same reasoning; `self` here is always Hera (`vm`'s own
-     * caller already resolved it that way in KH-ELEVATE-SEND, since
-     * ELEVATE-GRANT only ever runs on Hera). */
-    if (msg->type == SK_HERMES_MSG_TYPE_ELEVATE_REQUEST) {
-        uint64_t held, pulled, returned, consumed;
-        char line[160];
-        int conserved = stadium_conserved(self);
-        sk_hermes_ledger(&held, &pulled, &returned, &consumed);
-        snprintf(line, sizeof(line),
-            "Kernel-Hermes ELEVATE-REQUEST (real, Stage D): ledger held=%llu "
-            "pulled=%llu returned=%llu consumed=%llu stadium_conserved(self)=%s",
-            (unsigned long long)held, (unsigned long long)pulled,
-            (unsigned long long)returned, (unsigned long long)consumed,
-            conserved ? "true" : "FALSE");
-        console_println(line);
-    }
+    /* Off the queue BEFORE it runs (2026-10-14): running it can reach a
+     * colon-word checkpoint that drains this same VM again, and that
+     * drain must find the next message, not this one -- popped only after,
+     * a message whose payload calls a colon word ran twice (FABRIC-3.md
+     * SXXXVII). The message itself, and so its payload bytes, is still
+     * held until sk_hermes_release() below. */
+    sk_hermes_pending_pop(self);
 
     vm->mode = MODE_INTERPRET; /* a payload is never compiled into whatever
                                 * the enclosing context was mid-defining */
@@ -691,7 +678,6 @@ int sk_hermes_drain_checkpoint(VM *vm) {
     vm->abort_requested  = saved_abort;
 
     sk_hermes_release(msg);
-    sk_hermes_pending_pop(self);
 
     return drain_error ? -1 : 1;
 }