docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/heap.md

@@ -8,7 +8,7 @@ the thing that unlocks dynamic data structures — lists, hash maps, driver stat
 eventually a process table.
 
 It's generic kernel code (`system/kernel/heap.zig`): the allocator logic is
-architecture-neutral, using `arch.mapPage` and the frame allocator underneath.
+architecture-neutral, using `architecture.mapPage` and the frame allocator underneath.
 
 ## A growable free-list allocator
 
@@ -30,9 +30,10 @@ Allocations are 16-byte aligned; larger alignments aren't supported yet (the
 ## Growing on demand
 
 The heap lives in the **higher half** of the address space (virtual base
-`0xFFFF_8000_0000_0000`) — unmapped, well clear of the identity-mapped low half,
-and leaving the low half free for a future user address space. (That base is
-x86_64-canonical; another architecture would pick its own.)
+`0xFFFF_8000_0000_0000`) — unmapped, well clear of the low half, which belongs
+to user space (unmapped in the kernel's own tables; per-process user address
+spaces now map into it). (That base is x86_64-canonical; another architecture
+would pick its own.)
 
 When the free list can't satisfy a request, `grow` extends the mapped region: it
 pulls fresh frames from the [frame allocator](frame-allocator.md) and `map`s each