fix(hermes): one delivery path -- a VM takes its own messages on its own turn, never on another's stack

FABRIC-3.5 SXXXII, closing FABRIC-3 SXXIX bug 2 (SXXXVI).  A send marks the
receiver for the switch signal; the VM's own loop on its native stack takes
its messages and yields; Hera's idle beat makes the pending switch instead
of running other VMs' messages on her stack; every VM gets switcher turns
from birth; the drain refuses any call outside the VM's own context (the
test: it held every relayed line before, none now).

Found on the way: amd64's first-entry frame left rsp 8 bytes off the SysV
entry alignment (#GP on the first interpreter run on a VM's own stack), and
a VM yielding from its loop was marked SWITCHED_OUT, which stopped console
relay after one message and would have made KILL refuse it.

Relay of four lines to a WIREBIND identity on all three ISAs, five
hot-plugged identities, and standard acceptance (POST 1052, hash
0x08873e0f44b7cb2a) all pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/src/arch/amd64/switch.S

@@ -68,7 +68,15 @@ sk_vm_switch_to:
     .global sk_vm_switch_prime
 sk_vm_switch_prime:
     mov rax, rdi
-    sub rax, 56
+    /* 64, not 56 (2026-10-14): one more slot above the return address,
+     * where a caller's own return address would sit. `ret` into `entry`
+     * then leaves rsp at stack_top - 8, i.e. rsp + 8 a multiple of 16,
+     * exactly as after a real `call` -- the SysV ABI's entry alignment.
+     * With 56, entry began 8 bytes off: harmless while the entry function
+     * only switched back, a #GP (an aligned SSE store to the stack) the
+     * first time it ran the interpreter on this stack. */
+    sub rax, 64
+    mov qword ptr [rax+56], 0    /* no caller: a null return address */
     mov qword ptr [rax+0],  0    /* r15 */
     mov qword ptr [rax+8],  0    /* r14 */
     mov qword ptr [rax+16], 0    /* r13 */