fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v3/include/block_subsystem.h

@@ -255,10 +255,11 @@ typedef struct {
                                 * vm.c:611-624's exact pattern, applied to a
                                 * block instead of a word. */
     uint32_t acl_ttl;         /* countdown, same shape as DictEntry's
-                                * acl_ttl -- blocks support temporary
-                                * elevation too, same ACL-TTL-reuse
-                                * mechanism and Zuse-eligibility-list gating
-                                * as the word card (§H.5). */
+                                * acl_ttl, the same ACL-TTL mechanism as
+                                * the word card (§H.5). (Elevation on
+                                * request, and the Zuse eligibility list
+                                * that gated it, were removed 2026-10-14 --
+                                * FABRIC-3.md SXXXVII.) */
     uint8_t  acl_reserved[3]; /* still genuinely undecided -- deliberate
                                 * slack per "flexibility until we understand
                                 * the recipe," not a placeholder to fill