docs(sd): mark SD-on-SPI3 verified on hardware

Re-ran the spike on the dedicated SPI3 wiring (CLK 14 / MOSI 15) with
the same clean mount + atomic round-trip result. Flip the docs from
"pending a re-run" to verified.

firmware/README.md

@@ -71,9 +71,8 @@ binary — [`src/bin/sd_fat.rs`](src/bin/sd_fat.rs), flashed with `just flash-sd
 brings up the SD card, mounts FAT at `/sd`, and exercises the persistence
 module's atomic save (write `*.tmp` → fsync → rename → read-back). Per ADR-012
 the SD runs on its **own SPI3 host** — **SCK 14 · MOSI 15 · MISO 13 · SD CS 10**
-— leaving the EPD alone on SPI2. (The 2026-07-11 bench proof below ran on the
-earlier shared-SPI2 wiring; the code is now rewired to SPI3, pending a re-run
-after moving the SCK/MOSI jumpers to 14/15.)
+— leaving the EPD alone on SPI2. Verified on the dedicated SPI3 bus 2026-07-11
+(same mount + round-trip result as the initial shared-SPI2 bring-up).
 
 Bench result (genuine 32 GB SDHC card): mounts at 10 MHz, `29806 MiB total`,
 atomic round-trip byte-identical. Two findings baked into the code:
@@ -91,9 +90,8 @@ atomic round-trip byte-identical. Two findings baked into the code:
 for its whole lifetime, and persistence runs on its own thread, so a shared bus
 would need an EPD rewrite plus a cross-thread mutex on the save path. Instead the
 SD gets its own SPI3 — the EPD stays untouched, no arbitration. Remaining before
-persistence lands in `main.rs`: re-run the spike on the SPI3 wiring, then wire
-the atomic save (unlink-then-rename + `*.tmp` boot-recovery) into a `persistence`
-module.
+persistence lands in `main.rs`: wire the atomic save (unlink-then-rename +
+`*.tmp` boot-recovery) into a `persistence` module.
 
 **Spike 5 — partial refresh + typing: verified 2026-07-04.** `main.rs` wires
 the keyboard to the panel: [`src/usb_kbd.rs`](src/usb_kbd.rs) feeds decoded