fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

capsules/zuse.4th

@@ -12,8 +12,6 @@ Block 4016
 ( >BODY-then-store, so a pinned CONSTANT isn't tamper-proof. )
 ( Read with ZUSE-PUBKEY@ / ZUSE-CERT-INSTALLED? -- both C )
 ( primitives, read-only; the seed has no FORTH access at all. )
-( ZUSE-ELIGIBILITY-ADD denied by default -- see block 4017. )
-0 ['] ZUSE-ELIGIBILITY-ADD ACL-ALLOW!
 
 Block 4017
 ( ACL-ZUSE-BOOT ( -- ) re-invokable: capsule_zuse_boot.c )
@@ -25,8 +23,6 @@ Block 4017
 : ACL-ZUSE-BOOT ( -- )
   ZUSE-CERT-INSTALLED? IF
     ZUSE-AUTHENTICATE
-    1 ['] ZUSE-ELIGIBILITY-ADD ACL-ALLOW!
-    ['] ZUSE-ELIGIBILITY-ADD ACL-PIN
     LOG-INFO" zuse: activated"
   ELSE
     LOG-INFO" zuse: NOT activated -- no cert installed"