FABRIC-3.10.8 MC-3a: the claim, the physics lock, per-core decision state

VM.running_on claimed by compare-and-swap on switch-in and released once
the context is saved (release_after, sk_vm_switch_finish); a lost claim
returns 1 and the caller re-decides; double claims counted. Per-core
entry_vm and decision_due. g_lock_physics over capsule_vm_physics.c
(rank between switch and registry). KILL refuses a VM running anywhere.
Probe: 15737 claims, 0 lost, 0 double; a core-1 claim of Hera refused.
3-ISA acceptance with a 28-VM churn clean, 0 order violations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/vm.h

@@ -684,6 +684,10 @@ typedef struct VM
                                          *   entered (no context parked yet); non-zero only
                                          *   while VMRegistryEntry.state ==
                                          *   VM_STATE_SWITCHED_OUT for this VM. */
+    volatile uint32_t running_on;      /**< FABRIC-3.10.8 MC-3a: the core running this VM,
+                                         *   as core_id + 1 (a lock owner's encoding); 0 =
+                                         *   nobody. Claimed by compare-and-swap on switch-in,
+                                         *   released once its context is saved. */
     VMFrameStack frames;               /**< FABRIC-3.8.md §3.12 (Stage FR, 2026-09-23):
                                          *   this VM's execution frame stack -- the nested
                                          *   levels running on its own native stack, each