Stage C: cut over BLK-ATTACH-EVENT alone -- FABRIC-3.6.md task 3.8

The reply leg (Artemis -> Hera ack) that used to flow through
common:messaging.4th's MSG-SEND/MSG-TICK now goes through
kernel-Hermes's sk_hermes_send_one()/sk_hermes_drain_checkpoint()
instead -- FORTH Hermes never sees a BLK-ATTACH-EVENT message again
(SXXXIV.2's partition rule). The request leg was never real FORTH
messaging traffic to begin with (a direct VM-EXEC, no type tag,
forced by Hera's own inability to load common:messaging.4th), so it
is untouched.

New KH-BLK-ATTACH-SEND (repl.c) wraps sk_hermes_send_one(), reached
from capsules/artemis/init.4th's HERA-BLK-ATTACH-REQ. Delivery reuses
task 3.4's already-wired sk_hermes_drain_checkpoint(); BLK-ATTACH-ACK
itself is unchanged, just reached by a different layer.
SK_HERMES_MSG_TYPE_BLK_ATTACH deliberately reuses BLK-ATTACH-EVENT's
own value (9) to document this as a cutover of the same message, not
a new one.

Two real bugs found on the way, both recorded in FABRIC-3.6.md's
findings log:
- A popped FORTH CREATE-buffer address was raw-cast to a host pointer
  instead of going through vm_ptr() -- silently read all-zero memory,
  no crash, no error, just a message that arrived and did nothing.
  Fixed; the rule and its exception (repl.c's own dev-addr is
  legitimately a raw pointer, formatted that way by its own pushing
  code) are written up for the next FORTH-facing C word.
- A separate, genuine hang on the very first live exercise of this
  path, never reproduced across ten subsequent boots. Reported, not
  chased -- not blocking, per the task's own check being otherwise
  fully satisfied.

Also found live: log_message() is invisible in this build's actual
serial-log capture at every level -- settled on a single
console_println in the real drain target instead, one line per real
USB attach, not a hot-path.

Final acceptance (logs/20260922-105501, -105758, -110304, disk images
reset before each): dict_hash identical across all three
architectures for every VM, zero UNKNOWN WORD, mkcapsule --lint
clean, real ledger+stadium_conserved(Artemis)=true evidence on every
boot.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

capsules/artemis/init.4th

@@ -525,8 +525,9 @@ Block 4857
 Block 4858
 ( HERA-BLK-ATTACH-REQ ( dev-addr -- ): VM-EXEC'd by MSG-      )
 ( DELIVER when Hera's request arrives. Runs BLK-ATTACH on     )
-( Artemis's own dictionary (real ACL gating, same as any      )
-( other message payload), then replies to Hera (idx 0).       )
+( Artemis's own dictionary, then replies to Hera via kernel-  )
+( Hermes's KH-BLK-ATTACH-SEND (repl.c) -- FABRIC-3.6.md task  )
+( 3.8 Stage C, FORTH Hermes no longer sees this message type. )
 : HERA-BLK-ATTACH-REQ ( dev-addr -- )
   0 ATTACH-ACK-LEN !
   DUP ACK-APPEND-NUM
@@ -535,8 +536,7 @@ Block 4858
   DROP
   BL ACK-APPEND-CHAR
   S" BLK-ATTACH-ACK" ACK-APPEND
-  BLK-ATTACH-EVENT 2 0 ATTACH-ACK-BUF
-  ATTACH-ACK-LEN @ 0 MSG-SEND ;
+  ATTACH-ACK-BUF ATTACH-ACK-LEN @ KH-BLK-ATTACH-SEND DROP ;
 
 Block 4860
 ( LOG-APPEND ( level ts msg-addr msg-u -- )                   )