FABRIC-3.8.md Stage B: kernel-side idle loop in the switch trampoline

sk_vm_switch_entry() stops being the Stage-2 placeholder bounce and becomes
every switch participant's own idle loop: it drains one of its own
kernel-Hermes messages per pass, on its own native stack (driven by the drain's
return value, so a non-consuming drain cannot spin), and when nothing is
drained it marks the VM parked_idle and yields back. It is entirely OS-driven,
with no VM-side yield word. sk_hermes_drain_checkpoint() gains a per-VM
hermes_draining guard so a payload's own in-word checkpoint cannot drain a
second message inside the first. Still inert in normal operation: nothing
marks work until Stage C.

Finding fixed here: amd64 sk_vm_switch_prime built the first-entry frame at
top-56, entering with rsp 16-aligned instead of the SysV-required 8 mod 16, so
the first aligned SSE spill in a callee took #GP (logs/20260923-142526, kept).
It had been latent since SXXVIII Stage 2 because the placeholder never called
anything. The frame is now at top-64 with a zeroed pad slot. aarch64 and
riscv64 were already correct.

Evidence: a temporary kernel_main probe (reverted, not in this commit) queued
two messages to Hestia, the first calling a colon word, and switched into her.
It passed on all three ISAs: 0 pending, parked_idle, depth 0, context saved on
her own stack, SB-SEQ=12 (drained one at a time, not nested), ledger and
stadium_conserved restored. Formal acceptance without the probe on all three
ISAs: dict_hash identical and unchanged, zero UNKNOWN WORD or faults, and the
live WIREBIND mint -> USE -> 1 2 + . -> 3 relay.

FABRIC-3.8.md also records Captain Bob's rulings that no VM-side word ever gives
up control and that multitasking is a compudynamic hybrid, and opens SS3.12
(VM frames for per-VM execution state).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/starkernel/vm/switch.c

@@ -30,6 +30,8 @@
 #include "starkernel/vm/switch.h"
 #include "vm.h"
 #include "starkernel/capsule_birth.h" /* capsule_vm_set_state */
+#include "starkernel/vm/kernel_hermes.h" /* FABRIC-3.8.md §3.2 -- sk_hermes_drain_checkpoint() */
+#include "starkernel/hal/hal.h" /* sk_hal_panic() */
 #include <stdint.h>
 
 /* Arch-specific (switch.S in each arch dir). sk_vm_switch_prime() builds
@@ -97,10 +99,46 @@ void sk_vm_switch_set_current(VM *vm) { g_switch_current_vm = vm; }
  * itself, independent of vm_interpret()'s own attribution bookkeeping.
  * This placeholder's behavior is therefore unchanged from Stage 2.
  */
+/*
+ * FABRIC-3.8.md §3.2 (Stage B, 2026-09-23): the placeholder above is
+ * superseded -- this trampoline is now every switch participant's own
+ * kernel-side idle loop, the base of its native stack. Entirely OS-driven:
+ * nothing a VM executes decides to give up control (Captain Bob: "no
+ * special words saying I'm giving up control... strictly all operating
+ * system and strictly all compudynamically driven"). Each pass:
+ *
+ *   - Drain one of this VM's own kernel-Hermes messages, in its own
+ *     context, on its own stack (sk_hermes_drain_checkpoint() at depth 0
+ *     here, so the payload runs at this VM's depth 1 and its own word
+ *     checkpoints pass the Stage A ownership gate).
+ *   - If nothing was drained, this VM has no work: mark it parked-idle
+ *     (§3.5 -- nothing borrowed on its stack, nothing in progress) and
+ *     yield back to whoever switched in.
+ *
+ * Driven off the drain's return value, never a separate pending-count
+ * probe: any path where a drain returns without consuming a message would
+ * otherwise spin here forever with no word checkpoint to break it --
+ * indistinguishable from a switch storm. A failed yield is a kernel
+ * invariant violation, not something to retry, so it panics loudly.
+ *
+ * Deliberately NOT here yet (FABRIC-3.8.md §3.11, a Stage C design
+ * question): this point between messages is also a clean switch point
+ * (own stack, depth 0), and the compudynamic switch decision should be
+ * consulted here too, so a VM with a queue of checkpoint-free payloads
+ * cannot hold the CPU indefinitely.
+ */
 void sk_vm_switch_entry(void) {
     VM *self = g_switch_entry_vm;
     for (;;) {
-        sk_vm_context_switch(self, self->native_switch_back_to);
+        if (sk_hermes_drain_checkpoint(self) != 0) {
+            continue; /* consumed one message (1 = ok, -1 = payload erred) */
+        }
+        self->parked_idle = 1;
+        if (!self->native_switch_back_to ||
+            sk_vm_context_switch(self, self->native_switch_back_to) != 0) {
+            sk_hal_panic("switch trampoline: idle yield failed");
+        }
+        self->parked_idle = 0; /* resumed: someone switched back in */
     }
 }