Stage K-1: real kernel realloc; word-metrics defects closed (FABRIC-3.10.8 §4.1)

- Kernel sf_realloc() is a real realloc (copy min(old,new) via new
  kmalloc_usable_size(), free old, NULL-on-0 frees). It allocated fresh
  and nothing else: every growth leaked, and vm_state_push()'s call-state
  stack lost every saved state past depth 8 (found here).
- Shim realloc() copies min(old,new) (over-read when growing).
- Defect 9: FC bucket growth no longer leaks or patches a copy; no
  sf_xrealloc() (freed a block the index still held on failure).
- Defect 5: heat snapshot heap-sized (was heats[1024], truncating).
- Defect 6: word refused whole when its metrics can't be allocated.
- Defect 7: vm_cleanup() (both) frees metrics' inner arrays.
- Defect 8: most-likely-next kept incrementally; no full id scan.
- Probe (removed): realloc keeps contents, heap returns exactly; call
  stack depth 20 intact; all three ISAs. Churn criterion NOT met: ~7 KB
  retained per churned VM (quota slots/word rows -- K-4 re-measures); a
  post-churn CONSOLE-CMD refusal attributed to the quota leak, K-4 retests.
- Standard sequence on amd64/aarch64/riscv64: hashes, G, ledger unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/starkernel/kmalloc.h

@@ -62,6 +62,10 @@ int kmalloc_is_initialized(void);
 void *kmalloc(size_t size);
 void *kmalloc_aligned(size_t size, size_t align);
 void kfree(void *ptr);
+
+/* FABRIC-3.10.8 K-1: the size ptr was allocated with, or 0 if ptr isn't a
+ * live allocation from this heap. */
+size_t kmalloc_usable_size(const void *ptr);
 kmalloc_stats_t kmalloc_get_stats(void);
 uintptr_t kmalloc_heap_base_addr(void);
 uintptr_t kmalloc_heap_end_addr(void);