feat(v4.0.0): the node tells its kernel of its words; the boot seals the system

ENGINE.md 3b, the node's side of ruling A (a word's code is the node's, its
accounts the kernel's).

- dict.v4, system.v4: (WORD-DEFINED) ( xt -- ) is run when an entry is
  made, (WORD-FORGOTTEN) ( w -- ) when FORGET or COLD removes entries; with
  0 there no one is told, as on the hosted product
- test_host_quit.c: a kernel that keeps the list of words and is checked to
  hold exactly the node's dictionary after definitions, a vocabulary, an
  abandoned definition, FORGET, a refused FORGET and COLD; KERNEL-WORD
  called from the prompt and from a definition

Fixed, found while writing that test: since the capsules moved from build
time to boot time (294e6946), what COLD returns to and FORGET protects was
still the nucleus alone, so COLD lost U*, U/MOD and BYE and FORGET U* was
allowed.  The boot now seals the system when it has loaded it
(v4_image_seal), and hosted-check checks COLD, the capsule word after it,
the refused FORGET and BYE.

Verified: make -C v4 test passes at both widths (1283 checks in
test_host_quit.c); hosted-check passes on three ISAs; clean qemu with
STARFORTH_V4=1 on amd64, aarch64 and riscv64 passes POST, and COLD, U*
after it, FORGET U* (refused), an unserved kernel word and BYE typed at
each prompt are answered correctly (logs/20261005-193045, -193307, -193636).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/README.md

@@ -59,20 +59,21 @@ State, 2026-10-05, after `ENGINE.md` step 1: all six builds start the nucleus,
 load `v4:forth79.4th`, pass POST and reach `ok>`, with the same lines:
 
 ```
-PARITY:V4_NUCLEUS words=296 image_hash=0x736921433a2e0e97
-PARITY:V4_CAPSULE name=v4:forth79.4th capsule_id=... dict_hash=0x01a3a48159f28a3e
+PARITY:V4_NUCLEUS words=298 image_hash=0x2e02147b54f9ff47
+PARITY:V4_CAPSULE name=v4:forth79.4th capsule_id=... dict_hash=...
 PARITY:V4_POST tests=550 pass=550 fail=0
-PARITY:V4_CAPSULE name=v4:post79.4th capsule_id=... dict_hash=0x212b7b70848080e7
+PARITY:V4_CAPSULE name=v4:post79.4th capsule_id=... dict_hash=...
 PARITY:OK
 POST: PASSED
 ok>
 ```
 
-Bare-metal logs: `logs/20261005-185506/amd64/`, `logs/20261005-185734/aarch64/`,
-`logs/20261005-190101/riscv64/`. On each, six lines were then typed at the
+Bare-metal logs: `logs/20261005-193045/amd64/`, `logs/20261005-193307/aarch64/`,
+`logs/20261005-193636/riscv64/`. On each, seven lines were then typed at the
 prompt through the serial port — a definition, its use with the capsule's
-`U*`, an unknown word, a kernel word no one serves, and `BYE` — and each
-was answered as the hosted binary answers it. The
+`U*`, `COLD`, the capsule word again, a `FORGET` of it (refused), a kernel
+word no one serves, and `BYE` — and each was answered as the hosted binary
+answers it. The
 capsules were unsigned (no signing key on this machine).
 
 **A node is handed a line** (`docs/v4.0.0/ENGINE.md` 3.1). It does not read
@@ -94,6 +95,12 @@ words and is blocked while it waits at its port, which is what a system of
 many users and tasks, preemptive and cooperative, needs of it
 (`ENGINE.md` 3a).
 
+**The two products have parted** (`ENGINE.md` 3c). They share the engine,
+the FORTH-79 capsule and its POST; their nuclei may differ. The hosted
+product is its own and may become a hosted SDK. The bare-metal product is
+to be LithosAnanke with the node in the StarForth VM's place, and
+everything about word records, the fleet and identity is its alone.
+
 **This is still the lone node.** On bare metal `kernel_main.c` starts it
 before the fleet tables, beside the kernel's own system and not in the VM's
 place. `ENGINE.md` sets out the steps from here; step 1 is done and step 2 is