docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/power.md

@@ -83,16 +83,18 @@ On a `power_button` event or a `terminate` signal, init:
 3. requests `.power` `shutdown`.
 
 The service then enters **S5** (soft off) by writing `SLP_TYP | SLP_EN` to the
-PM1 control register(s) from ring 3, mirroring the kernel's own
-`system/devices/power.zig` `sleepValue`. If the write returns instead of powering
-the machine off, it logs loudly so a test fails rather than hangs.
+PM1 control register(s) from ring 3, with the `SLP_TYP` values taken from its own
+AML parse of the `_S5` object — the kernel has no S5 path of its own. If the
+write returns instead of powering the machine off, it logs loudly so a test
+fails rather than hangs.
 
 **No new system call was needed for S5.** The broad io_port grant on the
 `acpi-tables` node ([discovery.md](discovery.md)) already put the PM1 control
 ports in the acpi service's hands, so writing S5 from ring 3 is something it
 could physically already do; formalizing it as a protocol operation added a
-contract, not authority. The kernel keeps `power.zig` for its own test paths and
-panic-time poweroff, where no user space is available to ask.
+contract, not authority. The kernel's `system/devices/power.zig` keeps only
+**reboot** (the FADT reset register plus the legacy fallbacks, which need no AML);
+it has no poweroff path at all — S5 is not a kernel operation.
 
 ## Verifying it