docs: README, plan, guides and the site describe what is built now

README: rewritten around what runs (Linux software, Xorg, apk, Linux's drivers), the honest gaps, measured numbers.
plan/: 1.0.md is the finish line, where each clause of the acceptance test stands, and the register (one failing
clause: a root that survives a reboot); built plans (foundations, hybrid, alpine, xorg) and the decided-against one
(wayland) are gone, their content lives in architecture/; roadmap.md is only what is still open.
guides: building/layout/testing/adding-a-driver (Linux code may be used). history: four entries (ls -lR, TLB
shootdowns, MDIO 0x02460246, netlink MSG_TRUNC). Website: cards, stack, download page, docs index.
Code comments that pointed at deleted plan docs point at the architecture docs.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EVRhxi9zpdW2uDUN4FVcao

docs/architecture/kernel.md

@@ -438,6 +438,13 @@ allocation over 8 MB mapped straight into a neighbouring live mapping.
 - **Permissions are tracked but not enforced.** uid/gid are maintained honestly
   so `getuid()`/`setuid()` stop lying, and file access does not consult them;
   `setpriority` is the one place the uids are checked.
+- **`mprotect` is accepted and not enforced** (`sys_mprotect` returns 0). RELRO is not read-only,
+  a `PROT_NONE` guard does not fault, and nothing has `NX` (`EFER.NXE` is never set), so every
+  mapping is executable.
+- **`poll`, `select` and `epoll` wait a tick at a time** (10 ms at `HZ=100`) unless something
+  that can make a descriptor ready calls `poll_kick()` — which the pipe, socket and event paths
+  do. busybox's `wget` polls before every read and downloaded at 85 KB/s, a segment per tick,
+  until the network path started kicking.
 - **No swap**, and no memory pressure handling of any kind. `kalloc` failing is
   reported up as `-ENOMEM` and that is the whole policy.
 - **Nested signal delivery is not supported.** `in_signal` guards against