docs: audit all 'what's next' sections against the code; fix stale comments

Verified every deferred item in the nine docs with a what's-next section and
marked what has since landed (reaper, per-process CR3, higher-half kernel,
kernel heap, contiguous frame alloc, RSDP capture, cap-passing, driver restart
with backoff, PS/2 keyboard) while keeping the genuinely open items. Also
corrects interrupts.md's claim that the keyboard skipped the IO-APIC, and
updates scheduler.zig/heap.zig comments that predated the reaper and the big
kernel lock.

docs/scheduling.md

@@ -136,13 +136,14 @@ Three tests (see [testing.md](testing.md)) prove the guarantees:
 - **`event`** blocks a task on a wait queue; waking it (from another task) resumes
   it, and since it's higher priority it preempts immediately.
 
-## What's next (not done here)
+## What's next (partly done since)
 
-- **Priority inheritance.** Once tasks block on shared resources (locks, IPC),
-  danos will need it to bound priority inversion — a [real-time](vision.md)
-  requirement.
-- **Task exit / a reaper.** `exit` currently leaks the task's stack; nothing frees
-  finished tasks' memory yet.
-- **Per-address-space tasks.** Today all tasks share the kernel address space. User
-  processes will each get their own, switching page tables (CR3) on the context
-  switch.
+- **Priority inheritance** — still open. Tasks now do block on shared resources
+  (IPC rendezvous, the big kernel lock), and nothing yet bounds priority
+  inversion — a [real-time](vision.md) requirement.
+- **Task exit / a reaper** — done. A dying task goes on its core's reap list in a
+  `.reaping` state; the timer tick drains the list, frees the stack back to the
+  heap, and recycles the task-table slot.
+- **Per-address-space tasks** — done. User processes each own an address space,
+  and the context switch reloads CR3 when the target's tables differ (see
+  [paging.md](paging.md)).