docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/threading-plan.md

@@ -112,7 +112,7 @@ task's exit; make destruction happen on the **last** exit.
       (`address_space_refs`): `retainAddressSpace` takes a reference in `spawnUserLocked` (on the
       success path, after the slot + stack are secured), all under the big kernel lock.
 - [x] Both task-teardown paths ([scheduler.zig](../system/kernel/scheduler.zig):
-      `exitUserLocked` and `destroyTaskLocked`) call `releaseAspace`, which decrements
+      `exitUserLocked` and `destroyTaskLocked`) call `releaseAddressSpace`, which decrements
       and only `destroyAddressSpace`s at **zero**; an unretained space (hand-built test
       spaces) is destroyed directly, preserving prior behaviour.
 - [x] `-Dtest-case=address-space-refcount`: spawn and reap several ring-3 processes in sequence
@@ -134,9 +134,10 @@ Spawn only — no join yet. Prove a second task executes in the **caller's** add
 space and exits cleanly.
 
 - [x] [abi.zig](../system/abi.zig): `thread_spawn = 37`, `thread_exit = 38`. Handlers in
-      process.zig; `thread_spawn` calls `scheduler.spawnThread` (shares the caller's
+      process.zig; `thread_spawn` calls `scheduler.spawnThread` (today, after M3, the
+      handler goes `spawnThreadSupervised` → `scheduler.spawnUserLocked`; shares the caller's
       address space, `retainAddressSpace`); `thread_exit` ends the task like a process `exit(0)`
-      (`terminateCurrent` → `releaseAspace`). The closure pointer is delivered in the new
+      (`terminateCurrent` → `releaseAddressSpace`). The closure pointer is delivered in the new
       thread's **rdi** via a new `jump_to_user_arg` asm path (`t.user_arg`, 0 for a
       process) — no naked runtime asm.
 - [x] `library/runtime/thread.zig` (barrel-exported as `runtime.Thread`): `spawn` maps a
@@ -379,8 +380,9 @@ to the std shape and drop M3's per-thread exit endpoint:
       it enters the kernel to exit — so waking at *exit* time (not reap time) is safe, and
       no reaper/address-space juggling or user-memory write is needed. This is equally
       std-shaped (like `pthread_join`) and much simpler/safer than the planned
-      reaper-written completion word. `thread_spawn` no longer takes an exit endpoint (the
-      runtime passes `no_cap`); the per-thread IPC endpoint is gone.
+      reaper-written completion word. The runtime no longer passes `thread_spawn` an exit
+      endpoint (it passes `no_cap`; the kernel's 4th `exit_endpoint` arg remains and is
+      still honored); the runtime's per-thread IPC endpoint is gone.
 - [x] `thread-join` passes on the new path, and its join mode now runs **40 spawn+join
       cycles** — under the old per-thread-endpoint scheme those leaked handles would
       exhaust the 16-slot handle table; here they all succeed, proving join is endpoint-free.