fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/src/log_region.c

@@ -96,9 +96,8 @@ static int log_region_write_slot(uint32_t slot_index, const log_slot_t *slot) {
      * granularity, and a devblock holds LOG_SLOTS_PER_DEVBLOCK slots, so a
      * single-slot write must preserve its siblings. A read failure on a
      * never-yet-written devblock (blank fence content) is not fatal here --
-     * proceed with a zeroed buffer, matching zuse_eligibility.c's own
-     * "blank fence content is indistinguishable from absent, treat as
-     * absent" discipline. */
+     * proceed with a zeroed buffer: blank fence content is
+     * indistinguishable from absent, and is treated as absent. */
     if (blk_meta_zone_read(dft, devblock_buf) != 0) {
         memset(devblock_buf, 0, sizeof(devblock_buf));
     }