docs: flip stale status markers across the tracks (audit found 23)

An all-tracks docs-vs-code audit (the same method that caught the storage
drift) found 23 confirmed inaccuracies where a doc's build-status claim no
longer matches the source — status markers that were never flipped after a
track landed, and a few paths left over from completed flag-days. All verified
against the code before editing; docs only, no behavior change.

The systemic ones:
- IOMMU enforcement (driver-model.md, drivers.md): docs said enforcement was
  not built and "device_claim = ring 0" / "memory-safe is not true yet". It is
  built (per-device VT-d/AMD-Vi domains programmed at device_claim, -ECONFINE
  rollback, dma_alloc buffers bound and torn down at death; fail-open only with
  no IOMMU). Restated; M16 marker flipped to done.
- The FHS flag-day paths: /etc/devices.csv -> /system/configuration/devices.csv
  (devices-csv.md, new-driver-checklist.md, device-manager.md), /var/log ->
  /system/logs (logging.md, new-driver-checklist.md), /mnt/usb -> /volumes/usb
  (process-management.md). Following the old paths silently breaks driver match.
- protocol-namespace P4 "remaining" -> landed (only P5 remains); shared-fate
  fan-out "not yet enforced" -> enforced; wall_clock "not built" -> built;
  SMP affinity + fault-recovery "left" -> built; process_enumerate raw-pointer
  trust model -> checked copyToUser/EFAULT; bounds.md maximum_devices static
  hole -> dynamic per-registrar quota; init spawns fat -> volume-manager;
  config "hardcoded, move to /etc" -> already CSV data files; vdso.md three-
  value call; zig-self-hosting library/ layout; python argv "new" -> built.

Found and fixed by a multi-agent audit across 12 doc clusters, each finding
adversarially verified against the source.

docs/os-development/timers.md

@@ -36,9 +36,10 @@ and inside a VM alike; only the source behind it differs. The mechanism is in
 
 So the timer hardware lives in the kernel, and there is **no `hpet` driver and no time
 server** to consume. (An earlier HPET driver existed only to *demonstrate* the driver
-model; that role now lives in [drivers.md](../device-driver-development/drivers.md), as documentation.) The one place
-a user-space time service *is* justified — **wall-clock / calendar time** — is discussed
-at the end; it is deliberately not built yet.
+model; that role now lives in [drivers.md](../device-driver-development/drivers.md), as documentation.) The one part
+left to user space — **calendar policy** over wall-clock time (time zones, formatting) —
+is discussed at the end; the wall-clock *seconds* it builds on are a kernel syscall
+(`wall_clock`), like the monotonic clock.
 
 ## The three system calls
 
@@ -95,15 +96,17 @@ The raw wrappers (`clock`, `sleepMillis`, `timerOnce`) and the ergonomic
 `Instant`/`Duration` layer both live in the `time` module
 (`library/kernel/time.zig`); the latter is what everyday code uses.
 
-## Wall-clock time (not built)
+## Wall-clock time
 
 Everything above is **monotonic**: elapsed time since boot, perfect for timeouts and
-measurement, useless for "what is the date?" Calendar time — a real-time clock, time
-zones, leap seconds — is genuinely a **user-space** concern, and it *is* the case a time
-service is for. It would be backed by an **RTC** driver (the CMOS real-time clock), not
-the HPET, and exposed as a `CLOCK_REALTIME`-style service alongside the monotonic
-syscall. It is deferred until something needs it; the monotonic clock the kernel already
-owns covers every current use.
+measurement, useless for "what is the date?" Calendar time needs a **real-time clock**.
+The kernel owns wall-clock *seconds* as mechanism, exactly like the monotonic clock: the
+`wall_clock` syscall (#33) returns Unix epoch seconds (UTC). The CMOS **RTC** is read
+once at boot and anchored to the monotonic clock (`system/kernel/wall-clock.zig`), so a
+query is a cheap arithmetic offset rather than a per-call CMOS poll; `time`'s
+`wallClock()` (`library/kernel/time.zig`) wraps it. Reading the hardware's value is not
+policy — time zones, leap seconds, calendars, and formatting layer on top in user space.
+It exists because the filesystem needs real timestamps (mtime).
 
 ## Verifying it