FABRIC-3.8.md Stage B: kernel-side idle loop in the switch trampoline

sk_vm_switch_entry() stops being the Stage-2 placeholder bounce and becomes
every switch participant's own idle loop: it drains one of its own
kernel-Hermes messages per pass, on its own native stack (driven by the drain's
return value, so a non-consuming drain cannot spin), and when nothing is
drained it marks the VM parked_idle and yields back. It is entirely OS-driven,
with no VM-side yield word. sk_hermes_drain_checkpoint() gains a per-VM
hermes_draining guard so a payload's own in-word checkpoint cannot drain a
second message inside the first. Still inert in normal operation: nothing
marks work until Stage C.

Finding fixed here: amd64 sk_vm_switch_prime built the first-entry frame at
top-56, entering with rsp 16-aligned instead of the SysV-required 8 mod 16, so
the first aligned SSE spill in a callee took #GP (logs/20260923-142526, kept).
It had been latent since SXXVIII Stage 2 because the placeholder never called
anything. The frame is now at top-64 with a zeroed pad slot. aarch64 and
riscv64 were already correct.

Evidence: a temporary kernel_main probe (reverted, not in this commit) queued
two messages to Hestia, the first calling a colon word, and switched into her.
It passed on all three ISAs: 0 pending, parked_idle, depth 0, context saved on
her own stack, SB-SEQ=12 (drained one at a time, not nested), ledger and
stadium_conserved restored. Formal acceptance without the probe on all three
ISAs: dict_hash identical and unchanged, zero UNKNOWN WORD or faults, and the
live WIREBIND mint -> USE -> 1 2 + . -> 3 relay.

FABRIC-3.8.md also records Captain Bob's rulings that no VM-side word ever gives
up control and that multitasking is a compudynamic hybrid, and opens SS3.12
(VM frames for per-VM execution state).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/starkernel/arch/amd64/switch.S

@@ -68,7 +68,16 @@ sk_vm_switch_to:
     .global sk_vm_switch_prime
 sk_vm_switch_prime:
     mov rax, rdi
-    sub rax, 56
+    /* FABRIC-3.8.md Stage B finding (2026-09-23): was `sub rax, 56`, which
+     * entered `entry` with rsp == stack_top (16-byte aligned). SysV requires
+     * rsp == 8 (mod 16) at function entry (as if a `call` had just pushed a
+     * return address); off by 8, any compiler-emitted aligned SSE spill in
+     * the entry function's callees #GPs. Latent through Stage 2 because the
+     * placeholder trampoline never called anything that spilled; found live
+     * the moment the trampoline started draining (vm_interpret()). 64 leaves
+     * a zeroed pad slot above the entry address so entry sees rsp = top-8. */
+    sub rax, 64
+    mov qword ptr [rax+56], 0    /* pad: the fake caller's slot, never used */
     mov qword ptr [rax+0],  0    /* r15 */
     mov qword ptr [rax+8],  0    /* r14 */
     mov qword ptr [rax+16], 0    /* r13 */