docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/framebuffer.md

@@ -89,11 +89,13 @@ it.
 
 ## Two subtleties worth noting
 
-1. **`width` vs `pitch` in the loops.** In `fillRow`/`copyRow` we iterate `x`
-   up to `self.fb.width` — the *visible* count — but jump between rows with
+1. **`width` vs `pitch` in the loops.** In `fillRow` we iterate `x` up to
+   `self.fb.width` — the *visible* count — but jump between rows with
    `pitch`. That's the correct pairing: touch only real pixels, but skip the
    full stride (including padding) to reach the next row. We never write into
-   the padding, which is right.
+   the padding, which is right. (A `copyRow` used to sit alongside it; it's
+   gone — `scroll` was since rewritten as a writes-only screen clear, because
+   reading VRAM back is uncached-slow on real hardware.)
 
 2. **`volatile`.** The pointer is `volatile` because this memory is special —
    it's watched by the display hardware. `volatile` tells the compiler *"don't