docs: audit all 'what's next' sections against the code; fix stale comments

Verified every deferred item in the nine docs with a what's-next section and
marked what has since landed (reaper, per-process CR3, higher-half kernel,
kernel heap, contiguous frame alloc, RSDP capture, cap-passing, driver restart
with backoff, PS/2 keyboard) while keeping the genuinely open items. Also
corrects interrupts.md's claim that the keyboard skipped the IO-APIC, and
updates scheduler.zig/heap.zig comments that predated the reaper and the big
kernel lock.

docs/paging.md

@@ -124,13 +124,17 @@ Four tests (see [testing.md](testing.md)) pin down the guarantees:
 > pointer to force a real hardware access. And `invlpg`, like `lgdt`, needs its
 > operand staged through a register in inline asm.
 
-## What's next (not done here)
+## What's next (mostly done since)
 
-- **A kernel heap** — the first real user of `map`, giving the kernel dynamic
-  allocation. This is the natural next milestone.
-- **A higher-half kernel**: relink the kernel at a high virtual base so a future
-  user address space can own the low half.
-- **Per-address-space tables** once there are user processes, and shared/copy-on-
-  write mappings.
-- **Uncacheable MMIO**: the APIC/framebuffer pages are mapped writeback-cacheable;
-  real hardware wants MMIO marked uncacheable.
+- **A kernel heap** — done, built on `map` exactly as anticipated
+  ([heap.md](heap.md)).
+- **A higher-half kernel** — done: the kernel is linked at
+  `0xFFFFFFFF80000000` (`linker.ld`), loaded low and running high, and user
+  processes own the low half.
+- **Per-address-space tables** — done: each user process gets its own root with
+  the kernel half shared, and refcounted shared-memory mappings exist
+  ([ipc.md](ipc.md)). Copy-on-write remains unbuilt — nothing has needed it yet.
+- **Uncacheable MMIO** — half done: user-space device and DMA mappings are
+  strong-uncacheable and the framebuffer is write-combining via the PAT, but the
+  kernel's own `mapMmio` path is still writeback — the LAPIC included (see
+  [device-interrupts.md](device-interrupts.md)).