Fix EXECUTE/?/DUMP/TYPE/DECIMAL-HEX-OCTAL/ALIGN defects from proof sweep

proof/FINDINGS.md's Isabelle/HOL word-source sweep (§4) flagged five real
defects; this fixes all five and records resolution in that doc:

- EXECUTE (system_words.c): cast a popped cell straight to a DictEntry*
  and called through it with only a null check. Now validates via a new
  shared vm_dict_entry_ok(), promoted out of starforth_words.c's
  ENTROPY@/ENTROPY! guard (dictionary_management.c) so EXECUTE gets the
  same live-entry check.

- ? and DUMP (format_words.c): dereferenced the popped cell as a raw host
  pointer, bypassing vm_addr_ok entirely (out-of-VM-bounds read). Both now
  go through VM_ADDR/vm_addr_ok/vm_load_cell/vm_ptr like every other
  memory word (@, `,`, editor_words.c).

- TYPE (io_words.c): bounds check computed addr+count in signed 64-bit
  arithmetic, which can overflow and bypass the check on large operands.
  Replaced with vm_addr_ok(), which is written to avoid that overflow.

- DECIMAL/HEX/OCTAL (format_words.c): wrote only the BASE memory cell,
  never vm->base, the host-mirror field number-output words actually read
  via current_base() -- so these words silently affected number parsing
  but never printing. Now call the existing vm_set_base() (previously
  only used at boot init), which updates both. vm_get_base/vm_set_base
  promoted to public declarations in include/vm.h.

- ALIGN vs ALLOT/,/C,/2, (dictionary_words.c): disagreed on dictionary
  growth ceiling (2MB vs 5MB). Investigated which was correct rather than
  blindly widening: vm_get_block_addr() maps block N to
  vm->memory + N*BLOCK_SIZE across the full 5MB arena, and
  USER_BLOCKS_START (block 2048) lines up exactly with
  DICTIONARY_MEMORY_SIZE -- so ALLOT/,/C,/2, letting `here` grow past 2MB
  could silently corrupt live block/user data sharing that memory.
  Tightened ALLOT/,/C,/2, to DICTIONARY_MEMORY_SIZE to match ALIGN.

Verified: hosted (amd64) and kernel (amd64, __STARKERNEL__) both build
clean with -Wall -Werror; hosted POST suite 1012/1012 passing (0
regressions); manually exercised EXECUTE, ?/DUMP, TYPE, HEX/DECIMAL/OCTAL,
and large-ALLOT rejection in the REPL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Qf6YcnHgaEtEygq3knx19

src/word_source/format_words.c

@@ -157,19 +157,19 @@ void format_word_base(VM *vm) {
 /* DECIMAL ( -- ) — set BASE=10 */
 void format_word_decimal(VM *vm) {
     if (!vm) { return; }
-    vm_store_cell(vm, vm->base_addr, (cell_t) 10);
+    vm_set_base(vm, 10);
 }
 
 /* HEX ( -- ) — set BASE=16 */
 void format_word_hex(VM *vm) {
     if (!vm) { return; }
-    vm_store_cell(vm, vm->base_addr, (cell_t) 16);
+    vm_set_base(vm, 16);
 }
 
 /* OCTAL ( -- ) — set BASE=8 */
 void format_word_octal(VM *vm) {
     if (!vm) { return; }
-    vm_store_cell(vm, vm->base_addr, (cell_t) 8);
+    vm_set_base(vm, 8);
 }
 
 /* <# ( -- ) */
@@ -399,13 +399,12 @@ void format_word_question(VM *vm) {
         vm->error = 1;
         return;
     }
-    cell_t addr = vm_pop(vm);
-    cell_t *ptr = (cell_t *) (uintptr_t) addr;
-    if (!ptr) {
+    vaddr_t addr = VM_ADDR(vm_pop(vm));
+    if (!vm_addr_ok(vm, addr, sizeof(cell_t))) {
         vm->error = 1;
         return;
     }
-    print_number_formatted(vm, *ptr, 0, 0);
+    print_number_formatted(vm, vm_load_cell(vm, addr), 0, 0);
     putchar(' ');
 }
 
@@ -416,21 +415,21 @@ void format_word_dump(VM *vm) {
         return;
     }
     cell_t u = vm_pop(vm);
-    cell_t addr = vm_pop(vm);
+    vaddr_t addr = VM_ADDR(vm_pop(vm));
     if (u < 0) {
         vm->error = 1;
         return;
     }
-    uint8_t *ptr = (uint8_t *) (uintptr_t) addr;
-    if (!ptr) {
+    size_t n = (size_t) u;
+    if (!vm_addr_ok(vm, addr, n)) {
         vm->error = 1;
         return;
     }
-    size_t n = (size_t) u;
-    int addr_width = (int) (sizeof(uintptr_t) * 2);
+    const uint8_t *ptr = vm_ptr(vm, addr);
+    int addr_width = (int) (sizeof(vaddr_t) * 2);
 
     for (size_t i = 0; i < n; i += 16) {
-        unsigned long long a = (unsigned long long) ((uintptr_t) addr + (uintptr_t) i);
+        unsigned long long a = (unsigned long long) (addr + i);
         printf("%0*llX: ", addr_width, a);
         size_t j = 0;
         for (; j < 16 && i + j < n; j++) printf("%02X ", ptr[i + j]);