Stage A: fix USE's silent stack-underflow/bad-address guards, and the Hera fault-scoping gap they exposed (FABRIC-3.md §XXXII.1)

mama_word_use()'s two silent vm->error=1 guards (dsp<1 stack underflow,
NULL from vm_ptr()) now print a diagnostic and return, matching the
function's other five guards.

Live verification of that fix alone surfaced a bigger problem: with the
guard no longer silent, the REPL proceeds to interpret the leftover
token as an unrecognized word, which independently sets vm->error, and
sk_repl_step()/sk_repl_run()'s Hera-branch still hard-halted on that.
Investigated kernel_main.c's boot/capsule-load paths directly: they
already catch and clear mama->error entirely separately, before
sk_repl_run() is ever entered -- so the "no fallthrough surface" halt
in these two REPL functions was never protecting a boot-time fault, only
an ordinary interactive REPL-turn one. Both functions now recover
unconditionally on any VM's error, Hera included, matching how a
redirected (WIREBIND/USE'd) identity's session already recovered.
Removed the now-fully-unused sk_fault_handler().

Verified live, amd64: USE rajames at Zuse's own console prints the new
diagnostic, then "VM fault -- session recovered, resuming", console
stays interactive afterward. Three-arch clean qemu acceptance passed
before and after the Hera-fault-scoping change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

src/starkernel/capsule/mama_forth_words.c

@@ -449,7 +449,7 @@ void mama_word_use(VM *vm)
     const char     *src;
 
     if (vm->dsp < 1) {
-        vm->error = 1;
+        console_println("USE: expects S\" name\" USE -- nothing on the stack");
         return;
     }
 
@@ -464,7 +464,7 @@ void mama_word_use(VM *vm)
     /* caddr is a VM address; S" ( -- c-addr u ) stores chars directly at caddr */
     {
         const uint8_t *p = vm_ptr(vm, (vaddr_t)caddr);
-        if (!p) { vm->error = 1; return; }
+        if (!p) { console_println("USE: invalid address on the stack"); return; }
         src = (const char *)p;
     }
     for (i = 0; i < (uint32_t)u; i++) name_buf[i] = src[i];