Unify console prompt to [user@VM]; fix real personality-block truncation; correct §XXV's wrong lockdown conclusion (FABRIC-3.md §XXVI)

Investigating the std79 lockdown finding from FABRIC-3.md §XXV led
to a real discovery: WIREBIND births TWO VMs per identity, a console
proxy under the plain username and the actual restricted identity
under <username>~user (capsule_wirebind.c). Every test in §XXV
targeted the console proxy, which was never locked down at all.
Retested against the correct target (rajames~user): the lockdown
works exactly as designed. §XXV's "lockdown never engages" conclusion
was wrong -- corrected here, not deleted, since the mistake and how
it was caught are worth keeping (see the new feedback memory:
confirm which specific VM a name resolves to before concluding
anything, when a subsystem is known to birth more than one VM per
identity).

Two real, separate things found along the way are kept regardless
of that correction:

- capsule_runcap.c: the reserved personality devblock was read in
  full (mostly zero-padding after a short ~200-byte string) with no
  terminator, producing "WARN: block 4998 exceeds 1KB, truncating"
  on every std79-locked identity's birth, universal, since at least
  2026-09-10. Fixed by trimming to the first NUL byte actually found
  -- real, but harmless to execution (real content sat in the
  truncated block's surviving head); it mattered for capsule_id/
  content_hash being computed over padding instead of real content.

- console.h/console.c/repl.c: unified the prompt from a separately-
  computed "[VMName] (user)" into a single "[user@VMName]" line
  prefix -- exactly the ambiguity that caused the original
  misdiagnosis (the prompt showed only the WIREBIND username,
  identical whether USE had targeted the console proxy or the real
  ~user identity). Implemented as a registered callback
  (console_set_user_prefix_provider()) rather than console.c calling
  into WIREBIND/session logic directly, since console.c is a clean
  HAL module with no prior dependency on capsule-level subsystems.

Verified: clean build on all 3 architectures, zero new warnings,
identical dict_hash/capsule_hash to every prior boot this session
(console/prompt-only change). Full 9-identity messaging campaign
re-run end to end: 202s, zero faults, all 8 identities at 99/99
tokens, zero regression.

Also surfaced, not yet acted on: the full campaign's own console
tags now visibly show which VM each identity's tests actually
reached ([zuse@rajames], not [zuse@rajames~user]) -- messaging.4th's
VM-NAMES-INIT registers identities by plain username, so std79-doe.
fth's turn-attractor has been dispatching to each identity's console
proxy, not the actual locked-down identity, since the messaging
rewrite. Flagged for a deliberate decision, not investigated further.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo

src/starkernel/capsule/capsule_runcap.c

@@ -58,6 +58,34 @@ CapsuleRunResult capsule_runcap_birth(
         }
     }
 
+    /* FABRIC-3.md SXXV follow-up (2026-09-13): source_len above is the
+     * FULL reserved region (source_devblocks worth of 4KiB devblocks) --
+     * MINT (capsule_mint.c) only ever writes a short personality string
+     * into it and memset()s the rest of that one devblock to 0 first, but
+     * never touches whatever devblocks beyond the first were reserved for
+     * identity_src, and this loop reads all of them regardless. Real
+     * content is a handful of lines; everything past it, for the whole
+     * remaining reserved region, is zero bytes with no "Block N" header
+     * of its own to stop capsule_exec_payload()'s own block-flush scan --
+     * confirmed live as the actual cause of "WARN: block 4998 exceeds
+     * 1KB, truncating", firing for every std79-locked identity, every
+     * boot, since before this was found: the parser had no way to tell
+     * "real content ends here" from "just more of this same block," so it
+     * walked the whole zero-padded region as one oversized block. FORTH
+     * source never legitimately contains a raw NUL, so it's a safe,
+     * ordinary C-string-style terminator here: trim source_len down to
+     * the first NUL actually found, restoring the block-parser's normal
+     * behavior instead of teaching it a special case for this one
+     * caller's own padding convention. */
+    {
+        uint64_t real_len = source_len;
+        uint64_t k;
+        for (k = 0; k < source_len; k++) {
+            if (arena[k] == '\0') { real_len = k; break; }
+        }
+        source_len = real_len;
+    }
+
     /* Heap-built single-entry directory -- exact shape §F.6 traced
      * against capsule_birth_baby()'s own parameters, not a new mechanism.
      * Never freed: matches kernel_main.c's own compile-time-directory