Stage K-1: real kernel realloc; word-metrics defects closed (FABRIC-3.10.8 §4.1)

- Kernel sf_realloc() is a real realloc (copy min(old,new) via new
  kmalloc_usable_size(), free old, NULL-on-0 frees). It allocated fresh
  and nothing else: every growth leaked, and vm_state_push()'s call-state
  stack lost every saved state past depth 8 (found here).
- Shim realloc() copies min(old,new) (over-read when growing).
- Defect 9: FC bucket growth no longer leaks or patches a copy; no
  sf_xrealloc() (freed a block the index still held on failure).
- Defect 5: heat snapshot heap-sized (was heats[1024], truncating).
- Defect 6: word refused whole when its metrics can't be allocated.
- Defect 7: vm_cleanup() (both) frees metrics' inner arrays.
- Defect 8: most-likely-next kept incrementally; no full id scan.
- Probe (removed): realloc keeps contents, heap returns exactly; call
  stack depth 20 intact; all three ISAs. Churn criterion NOT met: ~7 KB
  retained per churned VM (quota slots/word rows -- K-4 re-measures); a
  post-churn CONSOLE-CMD refusal attributed to the quota leak, K-4 retests.
- Standard sequence on amd64/aarch64/riscv64: hashes, G, ledger unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/vm_bootstrap.c

@@ -62,6 +62,7 @@
 #include "../include/dictionary_heat_optimization.h"
 #include "../include/ssm_jacquard.h"
 #include "../include/platform_alloc.h"
+#include "../include/physics_pipelining_metrics.h" /* transition_metrics_cleanup() -- K-1 */
 #include "../include/vm_api.h" /* vm_input_ensure() -- S-1c */
 #include "word_source/include/vocabulary_words.h"
 
@@ -425,6 +426,8 @@ void vm_cleanup(VM* vm)
         while (dict_entry) {
             DictEntry *next_entry = dict_entry->link;
             if (dict_entry->transition_metrics) {
+                /* FABRIC-3.10.8 K-1: its own arrays first -- they leaked. */
+                transition_metrics_cleanup(dict_entry->transition_metrics);
                 sf_free(dict_entry->transition_metrics);
             }
             sf_free(dict_entry);