FABRIC-3.10.8 K-9: remove a dead VM's physics node at KILL and reap

vm_physics_remove() retires the node (heat to the root) and frees it;
capsule_vm_kill() and capsule_vm_force_reap() call it, so WIREBIND/EJECT
kills and reaps now retire too (before, only the KILL word did). A dead
VM now leaves only its registry node (168 B). 3-ISA acceptance clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/starkernel/capsule_vm_physics.h

@@ -61,7 +61,8 @@ void vm_physics_init(VMUuid vm_id);
 /**
  * vm_physics_retire - Remove a killed VM, returning its heat to Hera
  *
- * Called from mama_word_kill before the registry entry is torn down.
+ * Called by vm_physics_remove() (FABRIC-3.10.8 K-9) before the registry
+ * entry is torn down; mama_word_kill used to call it directly.
  * The dying VM's entire remaining heat is transferred up its
  * parent_vm_id chain (VMRegistryEntry, capsule_run.h) to the fleet's
  * single structural root, Hera -- no division, no per-survivor
@@ -73,6 +74,19 @@ void vm_physics_init(VMUuid vm_id);
  */
 void vm_physics_retire(VMUuid vm_id);
 
+/**
+ * vm_physics_remove - Retire a dead VM, then drop its node
+ *
+ * FABRIC-3.10.8 K-9: called from capsule_vm_kill() and
+ * capsule_vm_force_reap(), while the registry entry is still readable
+ * (retirement walks parent_vm_id). Heat goes to the root exactly as
+ * vm_physics_retire(); the node is then unlinked and freed, so a dead VM
+ * leaves nothing in the fleet list. Hera is refused.
+ *
+ * @param vm_id  Registry VM ID of the VM being torn down
+ */
+void vm_physics_remove(VMUuid vm_id);
+
 /**
  * vm_physics_touch - Record real dispatch activity against a VM
  *