Add the four ledger counters (held/pulled/returned/consumed) -- FABRIC-3.6.md task 2.4

FABRIC-3.5.md SXL.4's ledger: held == pulled - returned - consumed,
epsilon zero. Added sk_hermes_ledger() (an accessor, not a mutator)
plus four static counters in kernel_hermes.c.

Each counter has exactly one increment/decrement site: held/pulled
both move at sk_hermes_alloc()'s single success path, after every
refusal branch has already returned; held/returned both move at
sk_hermes_release()'s single success path. consumed is declared and
always reads 0 -- its one increment site doesn't exist yet, and won't
until task 2.5 gives decay something to record.

sk_hermes_release() now reads the Stadium cell's live header.heat
immediately before calling stadium_evict(), rather than assuming the
original pulled amount -- stadium_evict() zeroes the header as part of
freeing the cell and its own return value is a success code, not the
credited amount, so this is the only point the true remaining heat is
available. Today this always equals the original Q.SLOT pull; once
task 2.5's decay exists, this is what keeps returned correct without
touching this function again.

Self-test (kernel_main.c) extended: snapshots the ledger before
running so it checks its own deltas, verifies held/pulled grow by
exactly got_n * Q_SLOT on allocation with returned/consumed untouched,
then verifies held returns to its starting value and returned grows by
the same amount on release, and checks the audit invariant itself as a
bonus (task 2.6 formalizes this properly).

Three-arch boot clean: amd64/aarch64/riscv64 all reach [zuse@Hera] ok>,
zero UNKNOWN WORD, dict_hash unmoved. All three print PASS with
identical final ledger: held=0 pulled=65536 returned=65536 consumed=0.
No compiler warnings.

Authorized by Captain Bob ("keep going with rhe 6.5 document").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/starkernel/vm/kernel_hermes.h

@@ -194,6 +194,34 @@ int sk_hermes_alloc(VMUuid vm_id, SkHermesMessage **out_msg);
  */
 int sk_hermes_release(SkHermesMessage *msg);
 
+/*
+ * sk_hermes_ledger - Task 2.4 (item 28), the four counters FABRIC-3.5.md
+ * SXXXVII.3/SXL.4 name: held, pulled, returned, consumed. Each is touched
+ * at exactly one call site:
+ *
+ *   held      += pulled amount   -- sk_hermes_alloc(), on success only
+ *   held      -= returned amount -- sk_hermes_release(), on success only
+ *   pulled    += pulled amount   -- sk_hermes_alloc(), same site as held's
+ *   returned  += returned amount -- sk_hermes_release(), same site as held's
+ *   consumed  += decay delta     -- task 2.5, not yet wired; reads 0 until
+ *                                    then
+ *
+ * The audit invariant this ledger exists to make checkable (task 2.6,
+ * epsilon zero): held == pulled - returned - consumed. All four are
+ * exact integers (SXXXVII.3: "Nothing here is a measurement. There is no
+ * noise to tolerate.") -- this accessor is how task 2.6's audit, task
+ * 2.7's Stage B proof, and task 2.8's scan cross-check all read the same
+ * four numbers, rather than each keeping its own copy.
+ *
+ * @param held      Set to the current live total (may be NULL).
+ * @param pulled    Set to the cumulative total ever pulled (may be NULL).
+ * @param returned  Set to the cumulative total ever returned (may be
+ *                  NULL).
+ * @param consumed  Set to the cumulative total ever consumed by decay
+ *                  (may be NULL) -- always 0 until task 2.5.
+ */
+void sk_hermes_ledger(uint64_t *held, uint64_t *pulled, uint64_t *returned, uint64_t *consumed);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_VM_KERNEL_HERMES_H */