docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/process-management.md

@@ -12,13 +12,15 @@ made the file tree the whole interface (`echo kill > /proc/n/ctl`). Microkernels
 mostly abandon ambient PIDs: Minix and QNX route everything through a user-space
 process-manager server, and Fuchsia/seL4 control processes only through handles.
 
-danos rules out `/proc` **as the primitive**: here a `/proc` would be served by
-the VFS server — a user process — which would put the VFS in the path of process
-control. If the VFS (or anything under it) hangs, nothing could be listed or
-killed, *including the hung VFS*. The control plane for processes must not
-depend on a process. So the primitives are kernel system calls; a read-only
-`/proc` rendering can be layered on later, and a POSIX-style process-manager
-server can be built *from* these primitives when one is needed.
+danos rules out `/proc` **as the primitive**: the path router lives in the
+kernel (`fs_resolve`), but what is mounted under a path is served by a
+user-process filesystem server (the way FAT serves `/mnt/usb`) — a `/proc`
+would be one more such server, which would put a user process in the path of
+process control. If that server (or anything under it) hangs, nothing could be
+listed or killed, *including the hung server*. The control plane for processes
+must not depend on a process. So the primitives are kernel system calls; a
+read-only `/proc` rendering can be layered on later, and a POSIX-style
+process-manager server can be built *from* these primitives when one is needed.
 
 ## The three primitives
 
@@ -100,7 +102,11 @@ the architecture layer calls up into `tick`.
   (`releaseTaskResourcesLocked`), so a restarted driver can claim its hardware
   again — the cleanup half of [process-lifecycle.md](process-lifecycle.md)'s iron
   rule 1. The `claim-release` test proves the kill → release → re-claim cycle.
-- Kernel stacks of dead tasks are leaked, as on every exit path (no reaper yet).
+- ~~Kernel stacks of dead tasks are leaked~~ Closed (threading-plan M8): a task
+  exiting on its own core queues on the core's reap list in `.reaping` state, and
+  the next switch away (or tick) frees its kernel stack; one killed while off-CPU
+  has its stack freed synchronously by the reap itself. Both paths are accounted
+  by `live_stack_bytes`, which returns to baseline when no extra tasks are live.
 - ~~There is no exit status in the notification~~ Closed (M17.2): the kernel
   records how every process ends — exited, a fault class, or killed — before it
   posts the exit notification, and the supervisor reads it with