docs: flip stale status markers across the tracks (audit found 23)

An all-tracks docs-vs-code audit (the same method that caught the storage
drift) found 23 confirmed inaccuracies where a doc's build-status claim no
longer matches the source — status markers that were never flipped after a
track landed, and a few paths left over from completed flag-days. All verified
against the code before editing; docs only, no behavior change.

The systemic ones:
- IOMMU enforcement (driver-model.md, drivers.md): docs said enforcement was
  not built and "device_claim = ring 0" / "memory-safe is not true yet". It is
  built (per-device VT-d/AMD-Vi domains programmed at device_claim, -ECONFINE
  rollback, dma_alloc buffers bound and torn down at death; fail-open only with
  no IOMMU). Restated; M16 marker flipped to done.
- The FHS flag-day paths: /etc/devices.csv -> /system/configuration/devices.csv
  (devices-csv.md, new-driver-checklist.md, device-manager.md), /var/log ->
  /system/logs (logging.md, new-driver-checklist.md), /mnt/usb -> /volumes/usb
  (process-management.md). Following the old paths silently breaks driver match.
- protocol-namespace P4 "remaining" -> landed (only P5 remains); shared-fate
  fan-out "not yet enforced" -> enforced; wall_clock "not built" -> built;
  SMP affinity + fault-recovery "left" -> built; process_enumerate raw-pointer
  trust model -> checked copyToUser/EFAULT; bounds.md maximum_devices static
  hole -> dynamic per-registrar quota; init spawns fat -> volume-manager;
  config "hardcoded, move to /etc" -> already CSV data files; vdso.md three-
  value call; zig-self-hosting library/ layout; python argv "new" -> built.

Found and fixed by a multi-agent audit across 12 doc clusters, each finding
adversarially verified against the source.

docs/os-development/vdso.md

@@ -123,12 +123,15 @@ The calls that return two values in `rax:rdx` today — `dma_alloc`
 `fs_resolve` (route tag + node token / backend handle) —
 become functions returning a two-`u64` struct. The System V ABI returns a
 16-byte struct in `rax:rdx`, so the stub is a plain `syscall; ret` — the
-C-ABI spelling of the existing convention, at zero cost. The one call that
-returns *three* values — `ipc_reply_wait` (receive_len in `rax`, badge in
-`rdx`, received capability in `r8`) — exceeds the two-register return: its
-function returns a three-`u64` struct, which the ABI passes via a hidden
-result pointer, so that one stub stores `rax`/`rdx`/`r8` through the pointer
-after the `syscall` — a few instructions rather than one.
+C-ABI spelling of the existing convention, at zero cost. The calls that
+return *three* values — `ipc_reply_wait` (receive_len in `rax`, badge in
+`rdx`, received capability in `r8`) and `dma_alloc` when the region is
+`shareable` (virtual in `rax`, physical in `rdx`, handle in `r8`) — exceed the
+two-register return: their functions return a three-`u64` struct, which the
+ABI passes via a hidden result pointer, so each stub stores `rax`/`rdx`/`r8`
+through the pointer after the `syscall` — a few instructions rather than one.
+(`ipc_call` likewise carries a received capability in `r8` alongside its `rax`
+result.)
 
 Grouped as `abi.zig` groups them: