fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

capsules/artemis/init.4th

@@ -498,41 +498,16 @@ Block 4854
 STARTUP-BANNER
 
 Block 4856
-( Storage-attach ack builder. Hera sends "<dev-addr>          )
-( HERA-BLK-ATTACH-REQ"; reply is "<dev-addr> <ok?>            )
-( BLK-ATTACH-ACK" so identity birth only proceeds once        )
-( storage is confirmed (repl.c's BLK-ATTACH-ACK). Bob,        )
-( 2026-09-07.                                                  )
-CREATE ATTACH-ACK-BUF 64 ALLOT
-VARIABLE ATTACH-ACK-LEN
-: ACK-APPEND ( src-addr len -- )
-  DUP >R
-  ATTACH-ACK-BUF ATTACH-ACK-LEN @ +
-  SWAP CMOVE
-  ATTACH-ACK-LEN @ R> + ATTACH-ACK-LEN ! ;
-
-Block 4857
-: ACK-APPEND-CHAR ( char -- )
-  ATTACH-ACK-BUF ATTACH-ACK-LEN @ + C!
-  ATTACH-ACK-LEN @ 1+ ATTACH-ACK-LEN ! ;
-: ACK-APPEND-NUM ( n -- )
-  0 SWAP <# #S #> ACK-APPEND ;
-
-Block 4858
-( HERA-BLK-ATTACH-REQ ( dev-addr -- ): VM-EXEC'd by MSG-      )
-( DELIVER when Hera's request arrives. Runs BLK-ATTACH on     )
-( Artemis's own dictionary, then replies to Hera via kernel-  )
-( Hermes's KH-BLK-ATTACH-SEND (repl.c) -- FABRIC-3.6.md task  )
-( 3.8 Stage C, FORTH Hermes no longer sees this message type. )
+( HERA-BLK-ATTACH-REQ, dev-addr -- : Hera's storage-attach    )
+( request, VM-EXEC'd into Artemis. Runs BLK-ATTACH here, then )
+( replies with KH-BLK-ATTACH-SEND, dev-addr ok? -- sent? :    )
+( the kernel writes the reply text for Hera itself, from the  )
+( two numbers, for Artemis only -- so identity birth only     )
+( proceeds once storage is confirmed. Until 2026-10-14        )
+( Artemis built that text here and the word sent any text     )
+( from any VM, which Hera ran as Zuse: FABRIC-3.md SXXXVII.   )
 : HERA-BLK-ATTACH-REQ ( dev-addr -- )
-  0 ATTACH-ACK-LEN !
-  DUP ACK-APPEND-NUM
-  BL ACK-APPEND-CHAR
-  DUP BLK-ATTACH ACK-APPEND-NUM
-  DROP
-  BL ACK-APPEND-CHAR
-  S" BLK-ATTACH-ACK" ACK-APPEND
-  ATTACH-ACK-BUF ATTACH-ACK-LEN @ KH-BLK-ATTACH-SEND DROP ;
+  DUP BLK-ATTACH KH-BLK-ATTACH-SEND DROP ;
 
 Block 4860
 ( LOG-APPEND ( level ts msg-addr msg-u -- )                   )