docs: audit all 'what's next' sections against the code; fix stale comments

Verified every deferred item in the nine docs with a what's-next section and
marked what has since landed (reaper, per-process CR3, higher-half kernel,
kernel heap, contiguous frame alloc, RSDP capture, cap-passing, driver restart
with backoff, PS/2 keyboard) while keeping the genuinely open items. Also
corrects interrupts.md's claim that the keyboard skipped the IO-APIC, and
updates scheduler.zig/heap.zig comments that predated the reaper and the big
kernel lock.

docs/heap.md

@@ -65,11 +65,13 @@ the proof that free and the free list actually work, not just alloc; "heap growt
 forces allocation past the initial page so `grow`/`map` runs; and the `ArrayList`
 check is the std-integration payoff.
 
-## What's next (not done here)
+## What's next (largely still true)
 
-- **Thread/interrupt safety.** The heap assumes a single caller — no lock yet.
-  It's safe now (nothing allocates from interrupt handlers), but threads or an
-  allocating IRQ handler will need a lock (or `cli` around the critical section).
-- **Larger alignments** than 16 (for page-aligned buffers, DMA regions).
-- **`resize`/`remap` in place**, so growing an `ArrayList` needn't always copy.
-- **Reclaiming empty tail pages** back to the frame allocator when the heap shrinks.
+- **Thread/interrupt safety** — overtaken by the big kernel lock: SMP arrived
+  with a single kernel lock taken at every kernel entry, which serializes all
+  heap access. The heap still has no lock of its own, and needs none unless the
+  big lock is ever split.
+- **Larger alignments** than 16 — still unsupported; page-aligned and DMA
+  buffers come straight from the frame allocator instead.
+- **`resize`/`remap` in place** — still not done; growing an `ArrayList` copies.
+- **Reclaiming empty tail pages** — still not done; the heap only ever grows.