feat(kernel): v4 boots in the kernel's boot -- the Stadium, its checks, the opcode patrons

#189, ENGINE step 4, Phase 1 (plan 2026-11-13-engine-step4-phase1), Tasks
1-4. Captain Bob, 2026-11-13: Q1 "A new node key", Q2 "Per heartbeat
tick", Q3 "All of v3's", Q4 "In Phase 1" / "Full births now", who runs
next "Hera by compudynamics now" (Task 5, to come).

- stadium.c/.h: stadium_node_key(node) ("NODE" | number),
  stadium_boot_init_for(first), stadium_birth_node(key, name);
  stadium_boot_init() and stadium_birth_hera() are them for Hera's key, so
  v3's path is as it was (only an impossible panic's words changed).
- kernel_main.c: the system is chosen and said first, then the Stadium,
  sessions, switch-signal and kernel-Hermes tables for both systems in
  v3's order; v4: Hera, node 10, patron zero under her node key, the word,
  block and opcode layers. The quota self-test and the heartbeat's line
  are functions now, called by both systems.
- sk_v4.c/.h: sk_v4_run() goes -- sk_v4_boot() returns, the kernel's
  checks after POST (opcodes, words, conservation, quota, heartbeat), then
  sk_v4_prompt(). sk_v4_charge_opcodes() at the heartbeat's service points
  (the key wait, after each line) and once after POST.
- stadium_ops.c/.h: a node's 32 opcodes as Stadium patrons (HEAT-OP's
  feed, "Both"): retirements charged as the word layer's dispatches, a
  quantum each, the reservoir's floor kept, shared by retirements when
  short; cooling per tick as words. ~0.5 us a charge on the host: kept.
- qemu_session.py: a v4 acceptance boot fails without "Stadium: N cells",
  "Stadium conservation: CONSERVED" and the heartbeat's ticks (#189).

Tests first (logs/20261113-122142): the physics check failed on the v4
boot; test_stadium_node, test_stadium_ops (and its share case, after a
real boot showed ";" taking all the heat) failed before. Now: kernel host
tests all pass; amd64 v4 boot passes, POST 539/539, dict_hash unchanged,
"Stadium opcodes: 30 resident, hottest opcode 8", CONSERVED; a system=v3
boot prints its Stadium lines as on 2026-11-06.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm

kernel/include/starkernel/vm/stadium_ops.h

@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: LicenseRef-Starship-1.0
+ * Copyright (c) 2023-2026 Robert A. James
+ */
+/* stadium_ops.h -- a v4 node's opcodes as Stadium patrons (#189; plan
+ * 2026-11-13-engine-step4-phase1, Task 3).
+ *
+ * Captain Bob, 2026-11-12: "Add HEAT-OP. If it's a huge performance hit, we'll revert it" -- "Both":
+ * the registers (v4/include/v4/node.h) and the Stadium feed; 2026-11-13: "Per heartbeat tick".
+ * docs/v4.0.0/V3-PARITY.md 1c's reading -- "a VM's word patrons become its 32 opcode patrons" -- held
+ * since 1h left the opcodes unwired "for now"; this wires them, beside the word patrons, not instead.
+ *
+ * A node's 32 opcodes are patrons of its quota, behaviour COOL, each made resident on its first
+ * retirement as a word is on its first dispatch (stadium_words.c). At a charge, an opcode's
+ * retirements since the last charge are charged as that many of the word layer's dispatches -- the
+ * same quantum (STADIUM_WORD_HEAT_QUANTUM), the same floor left in the reservoir (a third); when
+ * they want more than there is, what there is is shared in proportion to the retirements, not taken
+ * by whichever opcode is charged first -- and a resident one first cools by the ticks since, as a
+ * word does
+ * (STADIUM_WORD_COOL_RATE_Q48). The kernel charges at its heartbeat's service points (sk_v4.c):
+ * where the node's host waits, and after each line. Conservation is the Stadium's: what is pulled is
+ * the node's own share.
+ */
+#ifndef STARKERNEL_VM_STADIUM_OPS_H
+#define STARKERNEL_VM_STADIUM_OPS_H
+
+#ifdef __STARKERNEL__
+
+#include <stdint.h>
+#include "starkernel/vm_uuid.h"
+
+#define STADIUM_OPS_COUNT 32u                          /* the F18 opcodes, 0 .. 31 */
+#define STADIUM_OPS_IDENTITY 0x4F50000000000000ULL     /* "OP" in a patron's identity, | the opcode */
+
+/* The per-quota tables; after stadium_boot_init_for(). Not re-entrant. */
+void stadium_ops_init(void);
+
+/* Charge the node `vm_id`'s opcodes: `counts` are its 32 running retirement counts (v4_heat.op),
+ * `tick` the heartbeat's count now. Nothing for a key with no quota. */
+void stadium_ops_charge(VMUuid vm_id, const uint64_t counts[STADIUM_OPS_COUNT], uint64_t tick);
+
+/* An opcode patron's heat now (Q48.16), or 0: not resident, or no quota. */
+uint64_t stadium_ops_heat(VMUuid vm_id, unsigned op);
+
+/* "Stadium opcodes: N resident, hottest opcode K" -- one line, at most 63 characters. */
+void stadium_ops_print_boot_diagnostics(VMUuid vm_id);
+
+#endif /* __STARKERNEL__ */
+#endif