Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

FABRIC.md -> FABRIC-0.md
FABRIC-2.md -> FABRIC-1.md
FABRIC-3.md -> FABRIC-2.md (the current/living document)
FABRIC-4.md unchanged (new #3 to follow separately)

Every cross-reference repo-wide updated to match, including doc-comment
citations inside kernel source (.c/.h) files -- done via an ordered
placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md->
placeholder1, FABRIC.md->placeholder0, then placeholders resolved to
final names) in a single pass per file to avoid double-shifting
already-renamed references.

One line in capsules/font.4th grew past the 64-char block-format limit
as a side effect of the longer filename; shortened it and reverified
with mkcapsule --lint (34/34 pass) before rebuilding.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after the fix; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

src/starkernel/capsule/capsule_zuse_boot.c

@@ -21,7 +21,7 @@
 #include <string.h>
 #include <stddef.h>
 
-/* FABRIC-3.md §I.8 (re-scoped 2026-09-04): tracks whether the currently
+/* FABRIC-2.md §I.8 (re-scoped 2026-09-04): tracks whether the currently
  * home-blocks-attached device is Zuse's own -- the single-USB-device
  * constraint (§F.8) means capsule_zuse_boot_logout() only needs one flag,
  * not a device/uuid comparison, to know a detach event is hers to act on
@@ -57,7 +57,7 @@ static void install_and_activate(VM *mama_vm, const uint8_t seed[32], const uint
      * once vm->zuse_cert_installed is already 1) -- that's a real
      * security property (the cert/pubkey must never be re-installed or
      * swapped) and stays untouched here. Its return is NOT used to gate
-     * ACL-ZUSE-BOOT below anymore (FABRIC-3.md §I.8, re-scoped
+     * ACL-ZUSE-BOOT below anymore (FABRIC-2.md §I.8, re-scoped
      * 2026-09-04): re-authenticating after capsule_zuse_boot_logout()
      * needs ACL-ZUSE-BOOT to re-run and re-set zuse_session even when
      * the cert itself was already installed from an earlier boot-time
@@ -81,7 +81,7 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
                                    const homeblocks_sig_t *sig,
                                    VM *mama_vm) {
     if (!dev || !mama_vm) return;
-    /* FABRIC-3.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
+    /* FABRIC-2.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
      * zuse_cert_installed. zuse_cert_installed never clears (one-way,
      * see install_and_activate()'s own comment) and would permanently
      * block re-authentication after a logout; zuse_session does clear