wip(kernel): the proxy Zuse -- a stick's first boot mints its own Zuse (#92, Task 1) [skip ci]

Work in progress on StarForth-v4.0.0; not yet accepted (plan
2026-10-29-stick-5, Task 1).

- zuse_genesis_marker.h: the marker's version 2 -- the proxy's key and the
  real Zuse's -- beside version 1.
- capsule_zuse_boot.c: capsule_zuse_boot_check_key() (the identity-record
  half of the check) and capsule_zuse_boot_genesis_mint() (the mint half of
  v3's genesis) split out; v3's two callers unchanged in behaviour.
- sk_v4_marker.c: the v4 boot reads version 1 as a proxy with no real Zuse,
  and writes version 2.
- sk_v4_identity.c: no marker and a blank identity partition -> genesis:
  mint, read back, then the marker; the proxy logs in. A marker with a real
  key: no session for the proxy (the fixed screen is Task 5).
- qemu_session.py: boot()/shutdown(), so a mode can boot twice; modes
  genesis and stick_genesis; stick_boot now expects genesis and the prompt.

Logs: genesis on amd64 before the change (both boots: "no genesis on this
disk", FAIL) and after (minted, then recognised: PASS). The DoE CSV of
032532 is from a run whose QEMU never started (no display; its empty log
directory was removed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel/include/starkernel/capsule_zuse_boot.h

@@ -50,6 +50,28 @@ zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
                                       const homeblocks_sig_t *sig,
                                       uint8_t seed[32], uint8_t pubkey[32]);
 
+/**
+ * capsule_zuse_boot_check_key - The identity-record half of
+ * capsule_zuse_boot_check(): the drive's identity record (magic, version,
+ * CRC-64) and its public key against @p want, with no marker read
+ * (plan 2026-10-29-stick-5, Task 1: the v4 boot checks against either of the
+ * version 2 marker's keys). ZUSE_DRIVE_HERS, with @p seed and @p pubkey
+ * filled in, or ZUSE_DRIVE_NOT_HERS. Writes nothing.
+ */
+zuse_drive_t capsule_zuse_boot_check_key(struct blkio_dev *dev,
+                                          homeblocks_sig_result_t sig_rc,
+                                          const homeblocks_sig_t *sig,
+                                          const uint8_t want[32],
+                                          uint8_t seed[32], uint8_t pubkey[32]);
+
+/**
+ * capsule_zuse_boot_genesis_mint - The mint half of v3's genesis, with no VM:
+ * Zuse's identity minted onto the blank drive @p dev (genesis mode,
+ * capsule_mint_identity()). Returns 0 with @p seed and @p pubkey filled in,
+ * or -1. Writes no marker: each caller writes its own.
+ */
+int capsule_zuse_boot_genesis_mint(struct blkio_dev *dev, uint8_t seed[32], uint8_t pubkey[32]);
+
 /**
  * capsule_zuse_boot_root_pubkey - Zuse's public key from the genesis
  * marker. Returns 0 with @p pubkey filled in, or -1 (no genesis yet, or the