fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/include/starkernel/vm/kernel_hermes.h

@@ -734,19 +734,9 @@ int sk_hermes_reassemble(SkHermesMessage **chunks, int n_chunks,
  * that type's real cutover, not a fresh kernel-Hermes-space number. */
 #define SK_HERMES_MSG_TYPE_CONSOLE_CMD 7
 
-/* SK_HERMES_MSG_TYPE_ELEVATE_REQUEST (FABRIC-3.6.md task 3.10, Stage D)
- * -- reuses messaging.4th's own now-historical ELEVATE-REQUEST value (8).
- * At task 3.10, SEND-ELEVATE-REQUEST/ELEVATE-GRANT/CH-REQUEST all FIND
- * live in Hera's own dictionary and SEND-ELEVATE-REQUEST was a real,
- * complete, directly-callable entrypoint (H.5/H.8's own design: any VM
- * wanting word-ACL elevation calls it with its own pubkey and the target
- * word name). FABRIC-3.6.md Phase 4, Stage E deleted messaging.4th
- * (SEND-ELEVATE-REQUEST's only definition) -- KH-ELEVATE-SEND below has
- * had no FORTH caller since, and ELEVATE-GRANT (zuse-eligibility.4th,
- * still loaded at boot) is unreachable. Found, not fixed -- Phase 8 PKI
- * decision needed before Phase 5 close-out, see FABRIC-3.6.md's own
- * Phase 4 entry. */
-#define SK_HERMES_MSG_TYPE_ELEVATE_REQUEST 8
+/* Type 8 (ELEVATE-REQUEST, FABRIC-3.6.md task 3.10) is retired: word-ACL
+ * elevation and Zuse's eligibility list were removed 2026-10-14 (FABRIC-3.7,
+ * closed as not needed; FABRIC-3.md SXXXVII). Not reused. */
 
 /* The five negotiation types above (20-24) were chosen clear of
  * messaging.4th's own live/reserved type space (PAUSE-EVENT=2,
@@ -754,7 +744,7 @@ int sk_hermes_reassemble(SkHermesMessage **chunks, int n_chunks,
  * BLK-ATTACH-EVENT=9, MSG-NACKED=253, MSG-DELIVERED=255) precisely
  * because none of them had a real cutover yet -- kernel-Hermes stayed
  * its own inert, parallel type space for those. SK_HERMES_MSG_TYPE_
- * BLK_ATTACH, _CONSOLE_CMD, and _ELEVATE_REQUEST above are the
+ * BLK_ATTACH and _CONSOLE_CMD above (and the retired 8) are the
  * deliberate exceptions: tasks 3.8/3.9/3.10 ARE those types' real
  * cutovers, so they reuse the FORTH-side value rather than picking a
  * fresh one. */