Fix use-after-free in sk_repl_idle()'s idle-tick VM resolution (FABRIC-3.md §XIII)

Root-caused a heap-corruption bug that reliably failed WIREBIND identity
attach on the third attach/detach cycle in one boot. sk_console_readline()
and sk_console_getkey() captured `active_vm` once from their caller and
kept passing that same (possibly long-stale) pointer to sk_repl_idle() on
every idle tick serviced while blocked waiting for input. If the VM it
pointed at was killed (WIREBIND detach) mid-block, the existing bailout
only checked a generic "is anyone attached" boolean -- masked as soon as a
different identity attached next -- so blk_vm_flush_all() kept writing
into a freed VM struct sitting on kmalloc's own free list, corrupting the
free list's linked-list metadata itself.

Both idle branches now re-resolve the live active VM fresh from
g_repl_active_vm on every tick, matching the dispatch-side fix already
made for the sibling bug in §XII.3.

Verified: rebuilt amd64, reran the exact three-cycle repro that reliably
corrupted the heap before the fix -- free-list census stayed stable
through the same idle window that previously collapsed to zero. All three
architectures (amd64/aarch64/riscv64) boot clean to the zuse)ok> prompt.

kmalloc_debug_census()/kmalloc_debug_census_bytes() kept as permanent
diagnostic infrastructure; every other temporary probe added during the
investigation was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo

src/starkernel/memory/kmalloc.c

@@ -339,3 +339,40 @@ kmalloc_stats_t kmalloc_get_stats(void)
 {
     return heap_stats;
 }
+
+void kmalloc_debug_census(size_t *out_largest_free, size_t *out_free_count,
+                           size_t *out_used_count, size_t *out_total_blocks)
+{
+    size_t largest = 0, free_count = 0, used_count = 0, total = 0;
+    heap_block_t *cur = heap_head;
+    while (cur) {
+        total++;
+        if (cur->free) {
+            free_count++;
+            if (cur->size > largest) largest = cur->size;
+        } else {
+            used_count++;
+        }
+        cur = cur->next;
+    }
+    if (out_largest_free) *out_largest_free = largest;
+    if (out_free_count)   *out_free_count   = free_count;
+    if (out_used_count)   *out_used_count   = used_count;
+    if (out_total_blocks) *out_total_blocks = total;
+}
+
+void kmalloc_debug_census_bytes(size_t *out_total_free_bytes, size_t *out_total_used_bytes)
+{
+    size_t free_bytes = 0, used_bytes = 0;
+    heap_block_t *cur = heap_head;
+    while (cur) {
+        if (cur->free) {
+            free_bytes += cur->size;
+        } else {
+            used_bytes += cur->size;
+        }
+        cur = cur->next;
+    }
+    if (out_total_free_bytes) *out_total_free_bytes = free_bytes;
+    if (out_total_used_bytes) *out_total_used_bytes = used_bytes;
+}