Stage M-A: manual messaging words -- CHANNEL, CHANNEL-CLOSE, JOIN/UNJOIN, JOIN-VM/LEAVE-VM, PUBLISH, INJECT, MAIL?, .MAIL, .CHANNELS (FABRIC-3.9.0 §7.2)

- Eleven words in repl.c over the existing kernel-Hermes C API, registered
  for every VM; `from` always derived in C. Names as ruled (M-1) except
  UNJOIN for LEAVE, which is FORTH-79's DO-loop exit (Captain Bob).
- INJECT (M-2) sends as the root, funded from Hera's reservoir, as new
  type 31; pinned STRICT in kernel_main.c beside BIRTH.
- Read-only accessors sk_hermes_pending_at() / sk_hermes_channel_member_at()
  for .MAIL / .CHANNELS.

Console evidence identical on amd64/aarch64/riscv64: PUBLISH delivers 2
(both print), LEAVE-VM then PUBLISH delivers 1, INJECT shows in MAIL?/.MAIL
as type 31 from Hera before the recipient runs, CHANNEL-CLOSE succeeds and
refuses channel 0, JOIN/UNJOIN, refusals 0/-1. dict_hash set changes by the
11 words (542 words) and is identical across ISAs; acceptance passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/starkernel/vm/kernel_hermes.h

@@ -426,6 +426,11 @@ int sk_hermes_channel_is_member(int channel_id, VMUuid vm_id);
  * or -1 if channel_id is invalid/not in use. */
 int sk_hermes_channel_member_count(int channel_id);
 
+/* sk_hermes_channel_member_at - the i-th member of channel_id (Stage M-A,
+ * for .CHANNELS). 0 and *out set, or -1 if the channel is invalid or i is
+ * past the member count. Read-only. */
+int sk_hermes_channel_member_at(int channel_id, size_t i, VMUuid *out);
+
 /* sk_hermes_channel_capacity - the table's boot-time-computed capacity
  * (0 if sk_hermes_channels_boot_init() was never called or failed) --
  * DoE/test observability, mirrors sk_vm_switch_signal_slot_capacity(). */
@@ -557,6 +562,11 @@ SkHermesMessage *sk_hermes_pending_peek(VMUuid vm_id);
  * vm_id has no queue or an empty one. */
 int sk_hermes_pending_pop(VMUuid vm_id);
 
+/* sk_hermes_pending_at - the i-th oldest queued message for vm_id (0 is
+ * the head, same as sk_hermes_pending_peek()), or NULL past the end
+ * (Stage M-A, for .MAIL). Read-only: nothing is removed or released. */
+SkHermesMessage *sk_hermes_pending_at(VMUuid vm_id, size_t i);
+
 /* Forward declaration only -- kernel_hermes.h deliberately does not
  * include vm.h (kept decoupled from the full VM struct, same posture as
  * every other type in this file), but sk_hermes_drain_checkpoint() below
@@ -788,6 +798,13 @@ int sk_hermes_reassemble(SkHermesMessage **chunks, int n_chunks,
  * type ever existed for it to reuse. */
 #define SK_HERMES_MSG_TYPE_SEND 30
 
+/* SK_HERMES_MSG_TYPE_INJECT (FABRIC-3.9.8 Stage M-A, FABRIC-3.9.0.md §7.2,
+ * ruling M-2) -- a message put in a VM's queue by the FORTH INJECT word
+ * "as if from the kernel": sender recorded as the root (Hera), funded from
+ * her reservoir. Interpreted exactly like SEND; a distinct type only so
+ * .MAIL and the log can tell an injected message from a sent one. */
+#define SK_HERMES_MSG_TYPE_INJECT 31
+
 /* The five negotiation types above (20-24) were chosen clear of
  * messaging.4th's own live/reserved type space (PAUSE-EVENT=2,
  * RESUME-EVENT=3, KILL-EVENT=4, CONSOLE-CMD-EVENT=7, ELEVATE-REQUEST=8,