docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/coding-standards.md

@@ -5,8 +5,8 @@ Conventions for danos source. The overriding one, from which most of the rest fo
 > **Names are spelled out in full. An identifier is not abbreviated unless the
 > abbreviation is an acronym.**
 
-`interruptDispatch`, not `intDisp`. `message_len`, not `message_len` (`msg` expands, `len`
-is a Zig idiom — see the exceptions). `devices_broker`, not `devices_broker`. `scheduler`, not
+`interruptDispatch`, not `intDisp`. `message_len`, not `msg_len` (`msg` expands, `len`
+is a Zig idiom — see the exceptions). `devices_broker`, not `dev_broker`. `scheduler`, not
 `sched`. The cost of a longer name is paid once, at the keyboard; the cost of a
 cryptic one is paid every time the code is read, by everyone who reads it. In a
 microkernel whose whole argument is that a human can hold each piece in their head,
@@ -98,8 +98,8 @@ Three, and only three.
 That's all — no Unix-abbreviation exception. The source directories are full words
 (`system`, `library`, not `src`/`lib`), and there is no daemon `d` suffix: a driver
 lives in `system/drivers/` and a service in `system/services/`, so the *location*
-already says what it is. Encoding the role in the name too (`busd`, `vfsd`) is
-redundant — the program is just `ps2-bus`, `vfs`. Don't put in a name what its directory
+already says what it is. Encoding the role in the name too (`busd`, `fatd`) is
+redundant — the program is just `ps2-bus`, `fat`. Don't put in a name what its directory
 already tells you.
 
 ## A note on collisions