feat(v4.0.0): address faults -- an address outside memory is guarded (D-14)

Ruled 2026-10-04: guarded, an error shown, back to the prompt.

- The executor checks every address a programme uses (P, A, B) before
  using it.  Outside memory the opcode does nothing, the rest of its word
  is not executed, and P becomes the node's fault handler; a node with no
  handler stops.  v4_node_load/store never index outside memory.
- capsule/quit.v4: (FAULT), the host node's handler, prints
  "Address out of range", ends an open definition, prints ERROR and
  returns to the prompt.
- tests: every memory opcode and P in test_exec.c; from the prompt, from
  inside nested words and loops, in test_host_quit.c.

This closes the hole node.h described: a wild address used to index the
model's own memory gigabytes out of bounds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/src/testcode.c

@@ -10,10 +10,8 @@ long v4_test_call(v4_node *n, v4_exec_state *es, v4_heat *h,
     n->p = entry;
     while (n->p != V4_TEST_HALT) {
         if (words >= max_words) return -1;
-        /* A golden model must not index outside its own memory on a runaway
-         * P; node.h leaves out-of-range addressing undefined. */
-        if (n->p < 0 || (v4_ucell)n->p >= V4_NODE_WORDS) return -1;
         (void)v4_exec_step_word(n, es, h);
+        if (n->stopped) return -1;              /* an address fault with no handler (D-14) */
         words++;
     }
     return words;