Punch list item 1: scratch-device MINT-SCRATCH, verified live on all 3 arches

Implements FABRIC-3.md §XXXII.2's scratch-thumbdrive mint mechanism:
capsule_mint_identity_scratch() (capsule_mint.c/.h) builds a throwaway
RAM-backed blkio_dev via blkio_ram.c's backend and runs
capsule_mint_identity() against it completely unmodified -- same live
Zuse-signing operation, same rng_get_bytes() draw for drive_uuid a real
thumbdrive gets. Reads back only drive_uuid + the cert devblock; the
seed devblock is written into the scratch buffer internally but never
read out (no seed is ever baked into a capsule, per the ratified
no-seed decision).

New FORTH word MINT-SCRATCH (mama_forth_words.c), same stack signature
as MINT, mints into the scratch device instead of any attached drive
and never touches sk_repl_get_attached_blk_dev() or console-pairing
state. Prints the drive_uuid as hex so a live boot log itself proves
each call drew fresh entropy.

Build correction found along the way: blkio_ram.c was excluded from
the kernel build (Makefile.starkernel VM_EXCLUDE) alongside
blkio_factory.c/blkio_file.c. blkio_factory_open() unconditionally
references blkio_file.c's real fopen()/fread() file I/O, which has no
freestanding-kernel equivalent, so the factory function couldn't be
used as-is. blkio_ram.c itself is pure memcpy over a caller buffer --
pulled it alone into the kernel build and wired it directly in
capsule_mint.c, the same way blkio_factory.c's own extern declarations
do internally.

Verified live on amd64: two MINT-SCRATCH calls produced two genuinely
different drive_uuids (b533246d.../ae11b2b2...), confirming fresh
entropy per call rather than stale reuse; VM stayed healthy afterward
(5 6 + . -> 11). Clean 3-arch qemu boot (amd64/aarch64/riscv64),
logs and DoE CSVs committed per standing convention.

Remaining punch-list items (hand-transcription into a .4th block, the
unattended-birth call site, the ACL cap bit) not started.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

include/starkernel/capsule_mint.h

@@ -133,6 +133,37 @@ MintResult capsule_mint_identity(struct blkio_dev *dev, VM *issuer_vm,
                                   MintPersonality personality,
                                   int drive_known_blank);
 
+/**
+ * capsule_mint_identity_scratch - Mint into a throwaway RAM-backed device
+ * instead of a real thumbdrive (FABRIC-3.md §XXXII.2, unattended-identity
+ * punch list item 1). Runs capsule_mint_identity() completely unmodified
+ * against a scratch blkio_dev built from the shared RAM backend
+ * (blkio_ram.c) -- same live Zuse-signing operation, same rng_get_bytes()
+ * draw for drive_uuid a real thumbdrive gets. "Scratch" describes only
+ * where the bytes are written; nothing about verification changes, and
+ * vm_identity_from_cert() needs no changes to consume the result later.
+ *
+ * The seed devblock capsule_mint_identity() writes internally is never
+ * read back here -- out_uuid/out_cert are the only two fields an
+ * unattended identity needs (FABRIC-3.md §XXXII.2 decision, 2026-09-16:
+ * no seed is ever baked into a capsule).
+ *
+ * @param issuer_vm   Same meaning as capsule_mint_identity()'s own --
+ *                    Zuse's cert lives here (in practice Hera).
+ * @param out_uuid    16 bytes, populated with the minted drive_uuid.
+ * @param out_cert    4096 bytes, populated with the raw (zero-padded)
+ *                    cert devblock -- matches capsule_wirebind_verify_
+ *                    cert()'s own read shape, so the same DER-length
+ *                    handling (parsed from the ASN.1 header, trailing
+ *                    padding ignored) applies at birth time later.
+ * @return Same MintResult capsule_mint_identity() itself returns.
+ */
+MintResult capsule_mint_identity_scratch(VM *issuer_vm,
+                                          const char *full_name, const char *username,
+                                          const char *email, const char *phone,
+                                          MintPersonality personality,
+                                          uint8_t out_uuid[16], uint8_t out_cert[4096]);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_CAPSULE_MINT_H */