wip(kernel): the proxy Zuse -- a stick's first boot mints its own Zuse (#92, Task 1) [skip ci]

Work in progress on StarForth-v4.0.0; not yet accepted (plan
2026-10-29-stick-5, Task 1).

- zuse_genesis_marker.h: the marker's version 2 -- the proxy's key and the
  real Zuse's -- beside version 1.
- capsule_zuse_boot.c: capsule_zuse_boot_check_key() (the identity-record
  half of the check) and capsule_zuse_boot_genesis_mint() (the mint half of
  v3's genesis) split out; v3's two callers unchanged in behaviour.
- sk_v4_marker.c: the v4 boot reads version 1 as a proxy with no real Zuse,
  and writes version 2.
- sk_v4_identity.c: no marker and a blank identity partition -> genesis:
  mint, read back, then the marker; the proxy logs in. A marker with a real
  key: no session for the proxy (the fixed screen is Task 5).
- qemu_session.py: boot()/shutdown(), so a mode can boot twice; modes
  genesis and stick_genesis; stick_boot now expects genesis and the prompt.

Logs: genesis on amd64 before the change (both boots: "no genesis on this
disk", FAIL) and after (minted, then recognised: PASS). The DoE CSV of
032532 is from a run whose QEMU never started (no display; its empty log
directory was removed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel/include/starkernel/zuse_genesis_marker.h

@@ -43,4 +43,26 @@ typedef struct {
 _Static_assert(sizeof(zuse_genesis_marker_t) == 4096,
                "zuse_genesis_marker_t must be exactly one 4 KiB devblock");
 
+/* Version 2 (docs/v4.0.0/STICK.md 6, 6a; plan 2026-10-29-stick-5, Task 1): the
+ * same magic and devblock, two keys -- the stick's proxy Zuse, minted at its
+ * first boot, and the real Zuse, minted onto a second stick (zero, and
+ * has_real 0, until she is). Written and read only by the v4 boot
+ * (sk_v4_marker.c), which reads a version 1 marker as a proxy with no real
+ * Zuse. v3 reads version 1 only, and never runs from a stick (STICK.md 5.5). */
+#define ZUSE_GENESIS_MARKER_VERSION_2 2u
+
+typedef struct {
+    uint32_t magic;            /* ZUSE_GENESIS_MARKER_MAGIC */
+    uint32_t version;          /* ZUSE_GENESIS_MARKER_VERSION_2 */
+    uint8_t  proxy_pubkey[32]; /* the stick's proxy Zuse */
+    uint8_t  real_pubkey[32];  /* the real Zuse, when has_real */
+    uint32_t has_real;         /* 1 once the real Zuse is minted */
+    uint32_t _reserved;        /* zero: makes the padding before crc explicit */
+    uint64_t crc;              /* CRC-64/ISO over every byte before this field */
+    uint8_t  _pad[4096 - (4 + 4 + 32 + 32 + 4 + 4 + 8)];
+} zuse_genesis_marker_v2_t;
+
+_Static_assert(sizeof(zuse_genesis_marker_v2_t) == 4096,
+               "zuse_genesis_marker_v2_t must be exactly one 4 KiB devblock");
+
 #endif /* STARKERNEL_ZUSE_GENESIS_MARKER_H */