feat(v4.0.0): the node tells its kernel of its words; the boot seals the system

ENGINE.md 3b, the node's side of ruling A (a word's code is the node's, its
accounts the kernel's).

- dict.v4, system.v4: (WORD-DEFINED) ( xt -- ) is run when an entry is
  made, (WORD-FORGOTTEN) ( w -- ) when FORGET or COLD removes entries; with
  0 there no one is told, as on the hosted product
- test_host_quit.c: a kernel that keeps the list of words and is checked to
  hold exactly the node's dictionary after definitions, a vocabulary, an
  abandoned definition, FORGET, a refused FORGET and COLD; KERNEL-WORD
  called from the prompt and from a definition

Fixed, found while writing that test: since the capsules moved from build
time to boot time (294e6946), what COLD returns to and FORGET protects was
still the nucleus alone, so COLD lost U*, U/MOD and BYE and FORGET U* was
allowed.  The boot now seals the system when it has loaded it
(v4_image_seal), and hosted-check checks COLD, the capsule word after it,
the refused FORGET and BYE.

Verified: make -C v4 test passes at both widths (1283 checks in
test_host_quit.c); hosted-check passes on three ISAs; clean qemu with
STARFORTH_V4=1 on amd64, aarch64 and riscv64 passes POST, and COLD, U*
after it, FORGET U* (refused), an unserved kernel word and BYE typed at
each prompt are answered correctly (logs/20261005-193045, -193307, -193636).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/v4.0.0/ENGINE.md

@@ -289,9 +289,24 @@ its logs.
    `v4/tests/test_port.c`; six builds agree; `BYE` and an unserved request
    typed at each bare-metal prompt. `logs/20261005-185506`, `-185734`,
    `-190101`.
+   **The node tells its kernel of its words, 2026-10-05** (3b). An entry
+   is made in one place in the nucleus and entries go in two; each now
+   tells through a variable holding the xt of a word to run:
+   `(WORD-DEFINED)` ( xt -- ) from `(HEADER)`, `(WORD-FORGOTTEN)` ( w -- )
+   from `FORGET` and `COLD` (`v4/capsule/dict.v4`, `system.v4`). With 0
+   there, as on the hosted product, no one is told. `test_host_quit.c` is a
+   kernel that keeps the list and checks it is exactly the node's
+   dictionary after definitions, a vocabulary, an abandoned definition,
+   `FORGET`, a refused `FORGET` and `COLD`.
+   **Found and fixed with it:** since the capsules moved from build time to
+   boot time, what `COLD` returns to and `FORGET` protects was still the
+   nucleus alone, so `COLD` lost `U*`, `U/MOD` and `BYE`. The boot now
+   seals the system when it has loaded it (`v4_image_seal`); `hosted-check`
+   checks it. `logs/20261005-193045`, `-193307`, `-193636`.
    **Not done:** v3's own C functions serving a node. They take a `VM *`
    and use `vm_push`, `vm_pop` and, in places, the stack's fields directly;
-   a node has to stand behind that `VM` record first.
+   a node has to stand behind that `VM` record first. That, the records
+   themselves, and the kernel's interpreter file are step 4.
 3. **A word is being executed (3.5).** The hook at `call`; the ACL's
    countdown and recheck; the word's count; `stadium_word_dispatch`.
    In-line words become calls. The per-call-target count goes.