Stage MC-0d: Stadium partitioned by quota slot, one lock per slot (FABRIC-3.10.8 §3.5)

- Ruling (Captain Bob): per-slot locks, not "own path needs no lock" --
  a lock only on the cross-slot side can't exclude an unlocked owner
  (Hermes release evicting a sender's cell while the sender admits).
  FABRIC-3.10.0 §3.6 amended.
- StadiumVMQuota.lock covers the slot's lists, reservoir, consumed, word
  row and its cells. Word dispatch holds only its own slot lock for the
  whole dispatch (*_in_slot forms); peek-then-pull is one step.
- g_lock_stadium: grant slot allocation (new slot published with release
  in_use) and the shared block table (ruled: the one shared-lock Stadium
  path). Taken before a slot lock.
- Bitmap bytes set/cleared atomically (8 cells, possibly 8 slots).
- Cross-slot writers moved under the owner's lock: Hermes decay
  (stadium_cell_decay), Hermes release ledger (stadium_evict_credit),
  session pin (stadium_cell_set_pin). stadium_conserved() one hold.
- Word and block cell lookups check the cell is still this slot's.
- Probe (removed), identical on all three ISAs: 10,746,599 of 10,746,616
  word dispatches took exactly one lock (own slot), the 17 others all row
  growths; every live VM conserved; Hermes audit failures 0.
- Findings reported: births/USE run a VM's words while another VM is the
  core's current VM (MC-3 claim must cover it); quota slots never
  released; owner admission can evict a live message cell (latent, 0).
- Standard sequence on amd64/aarch64/riscv64: dict_hash set and G
  byte-identical, MINT/WIREBIND/USE ok, conservation true, 0 idle growth.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/starkernel/spinlock.h

@@ -50,6 +50,11 @@
  *     g_lock_switch     switch-signal slot table and stamps
  *                       (capsule_vm_switch_signal.c)
  *     g_lock_registry   VM registry list and entries (capsule_birth.c)
+ *     g_lock_stadium    Stadium's global part: quota-slot allocation
+ *                       (grants) and the shared block table (MC-0d)
+ *     (slot lock)       one Stadium quota slot: its lists, reservoir,
+ *                       consumed, word row and cells (stadium.c's
+ *                       StadiumVMQuota.lock; at most one held at a time)
  *     g_lock_doe        DoE region (doe_region.c)
  *     g_lock_log        log region (log_region.c)
  *     g_lock_block      block subsystem: device chain, caches, BAM,
@@ -63,8 +68,10 @@
  * The switch table and the registry never call out while held: their walks
  * copy one entry under the lock and judge it outside. Hermes hands the
  * switch module its notifications after dropping its own lock (they read
- * Hermes queues back). Stadium's lock comes with MC-0d; it sits below
- * Hermes (Hermes admits and evicts cells).
+ * Hermes queues back). Stadium sits below Hermes (Hermes admits, evicts and
+ * decays cells) and below a VM's dict_lock (vm_core.c's heat bump dispatches
+ * the word under it), and above block (MIGRATE calls blk_flush()); nothing
+ * in the block path calls into Stadium.
  */
 #ifndef STARKERNEL_SPINLOCK_H
 #define STARKERNEL_SPINLOCK_H
@@ -102,6 +109,7 @@ uint64_t sk_lock_bad_releases(void);
 uint64_t sk_lock_held_at_switch(void);
 
 extern sk_spinlock_t g_lock_registry;
+extern sk_spinlock_t g_lock_stadium;
 extern sk_spinlock_t g_lock_switch;
 extern sk_spinlock_t g_lock_hermes;
 extern sk_spinlock_t g_lock_doe;