FABRIC-3.10.8 MC-3a: the claim, the physics lock, per-core decision state

VM.running_on claimed by compare-and-swap on switch-in and released once
the context is saved (release_after, sk_vm_switch_finish); a lost claim
returns 1 and the caller re-decides; double claims counted. Per-core
entry_vm and decision_due. g_lock_physics over capsule_vm_physics.c
(rank between switch and registry). KILL refuses a VM running anywhere.
Probe: 15737 claims, 0 lost, 0 double; a core-1 claim of Hera refused.
3-ISA acceptance with a 28-VM churn clean, 0 order violations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/starkernel/percpu.h

@@ -67,6 +67,12 @@ typedef struct sk_percpu {
     uint64_t          reg_readback;  /* its per-CPU register, read on arrival */
     volatile uint32_t online;        /* 1 once parked (release store) */
     volatile uint64_t park_wakes;    /* times woken while parked */
+    /* MC-3a (switch.c): the VM this core just switched away from, released
+     * (running_on cleared) by whatever next runs here -- only once its
+     * context is saved. And this core's "re-decide at the next checkpoint". */
+    struct VM        *release_after;
+    volatile uint32_t decision_due;
+    struct VM        *entry_vm;      /* the VM a first-entry trampoline starts as */
 } sk_percpu_t;
 
 /* Installs the boot core's block in this core's per-CPU register. Call