Stage S-1c: WORD's buffer is per VM; input buffers allotted at VM init, below all compiled code (FABRIC-3.9.0 §8.1)

- The static word_scratch_addr shared by every VM is gone: WORD builds in
  vm->word_buf (257 bytes: count + 255 + NUL). A token over 255 chars is
  refused whole (delimiter restored, >IN unconsumed, vm->error), logged at
  LOG_ERROR and counted -- no more silent cut to 62 chars.
- Pre-existing corruption found by the probe: TIB/>IN/SPAN (and WORD's
  scratch) were allotted lazily at HERE; POST's restore_dict_state(),
  FORGET and COLD rolled HERE below them and compiled the dictionary over
  them (Hera's TIB lay under ACL-RECHECK's body; QUERY/WORD wrote into
  code). Per Captain Bob, all four are now allotted first in both
  vm_init()s (offsets 0-1305); COLD's clamp never goes below them.

Probe (reverted), identical on amd64/aarch64/riscv64: 0 colon bodies inside
the buffers; per-VM isolation; 62/100/255-char tokens full length; 300
refused and counted; interpreter sane after full-width TIB writes.
3-ISA acceptance passes; M7.1a hash and dict_hash set unchanged (here
0xd8 -> 0x5f8).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/vm_bootstrap.c

@@ -62,6 +62,7 @@
 #include "../include/dictionary_heat_optimization.h"
 #include "../include/ssm_jacquard.h"
 #include "../include/platform_alloc.h"
+#include "../include/vm_api.h" /* vm_input_ensure() -- S-1c */
 #include "word_source/include/vocabulary_words.h"
 
 #ifdef __STARKERNEL__
@@ -245,6 +246,17 @@ void vm_init(VM* vm)
         memset(p, 0, 64);
     }
 
+    /* FABRIC-3.9.8 Stage S-1c: the input buffers (TIB, >IN, SPAN, WORD's
+     * buffer) are allotted here, before any definition, so no HERE rollback
+     * (test harness restore, FORGET, COLD) can reach below them. Same as the
+     * kernel's vm_init(). */
+    if (vm_input_ensure(vm) != 0)
+    {
+        vm->error = 1;
+        log_message(LOG_ERROR, "vm_init: input buffers could not be allotted");
+        return;
+    }
+
     vm_bootstrap_scr(vm);
 
     vm->mode = MODE_INTERPRET;