feat(v4.0.0): hosted golden model, single node

First code for StarForth v4 (JUSTIFICATION.md section 10, step 1): one node
of the 32-instruction core as a C99 model, with cell width as a build
parameter.

- Node: P, A, B, F18 circular stacks (10 and 9 deep, D-2), word-addressed
  memory (D-1), 5% guard bands on every bounded list.
- Instruction word: six 5-bit slots in 32 bits at every cell width.
- Executor: all 32 opcodes of DECOMPOSITION.md 1.3. Cell arithmetic wraps
  explicitly; no signed overflow or implementation-defined shift.
- Heat: per-opcode and per-call-target counters and the anti-clock, driven
  by instruction retirement (1.4, D-6 interim).
- Slot packer and runner for tests, and a reference unsigned multiply in
  plain C99 with no 128-bit type.

Tests run at 32- and 64-bit cells, and under ASan and UBSan. They cover
every opcode and execute the first section 4 definitions (NIP SWAP OR
NEGATE ROT 0< 0= 2DUP - U<) against the C operation each stands for.

UM* as written in section 4 is exact only while u1 <= 2^(n-2). Two known
failing cases are pinned in test_foundation.c until it is rewritten.

DECOMPOSITION.md: record D-9, the instruction word is 32 bits at every
cell width (ruled 2026-10-02).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/src/guard.c

@@ -0,0 +1,15 @@
+/* guard.c -- 5% safety boundaries.  See guard.h. */
+#include "v4/guard.h"
+
+void v4_guard_fill(v4_cell *band, unsigned n, v4_ucell pattern)
+{
+    for (unsigned i = 0; i < n; i++) band[i] = (v4_cell)pattern;
+}
+
+int v4_guard_intact(const v4_cell *band, unsigned n, v4_ucell pattern)
+{
+    for (unsigned i = 0; i < n; i++) {
+        if ((v4_ucell)band[i] != pattern) return 0;
+    }
+    return 1;
+}