Docs: bring the documentation in line with the code

- Demo docs replaced by the screencast docs (single source of truth): the
  legacy demo-session.sh/demo-record.py and the v0.9 renderer were removed
  instead of being kept as a second convention.
- feature-matrix: stale 'M2-in-progress' vocabulary gone; the rows the 15
  gates prove now say VERIFIED-in-VM and name the gate; af-to is now an
  explicit non-goal row (INET6 0 in this build).
- guide: the queues/divert/pflog sections described a state that no longer
  exists (priq-only, divert dropping packets, pflog logging nothing); they
  now describe the shipped behaviour.
- vm-lab: the 15 real gates with what each proves, 15/15 green, and the
  pf0 -> cli/srv/gw2 ssh setup the screencasts rely on.
- install/build: pdivert and pflogd are built and ported (docs said
  otherwise); module object list now includes hfsc.c, fq_codel.c, pfk_pflog.c;
  the screencast pipeline is an optional build stage.
- pf-guide: the 'M2 scope only' framing is gone; honest gaps listed.
- caveats: three new sections about the screencast pipeline (MiniMax video
  generation blocked by the account tier, narration as a separate track, a
  video frame is not a verdict).
- porting-notes: what the recording taught us.
- README/README.pt-BR: status, milestones, layout and video section updated.

All internal doc links verified.

docs/en/README.md

@@ -4,8 +4,8 @@ Documentação em português: [`docs/pt-BR/README.md`](../pt-BR/README.md).
 
 This is the user documentation set for the port of the **OpenBSD 8.0 PF
 packet filter** to **Linux 7.3.4** — the real PF engine (`pf.c`, `pf_norm.c`,
-`pf_table.c`, `pf_lb.c`, …) running as the out-of-tree module `pf.ko`, driven
-by the real OpenBSD `pfctl` over the `/dev/pf` ioctl ABI.
+`pf_table.c`, `pf_lb.c`, `hfsc.c`, …) running as the out-of-tree module
+`pf.ko`, driven by the real OpenBSD `pfctl` over the `/dev/pf` ioctl ABI.
 
 ## Index
 
@@ -14,9 +14,10 @@ by the real OpenBSD `pfctl` over the `/dev/pf` ioctl ABI.
 | [guide.md](guide.md) | One-page architecture: components, data path, control plane, milestones |
 | [install.md](install.md) | Apply/build/install recipe (kernel, module, tools) |
 | [build.md](build.md) | Build pipeline in detail: fetch → vendorize → kernel → module → pfctl |
-| [vm-lab.md](vm-lab.md) | The libvirt validation lab: topology, recreate/run, what each gate proves |
-| [feature-matrix.md](feature-matrix.md) | Per-feature status: VERIFIED-in-VM / COMPILES-untested / PENDING-Mx |
-| [pf-guide.md](pf-guide.md) | Daily use: what works today in `/etc/pf.conf`, what to avoid until M3/M4 |
+| [vm-lab.md](vm-lab.md) | The libvirt validation lab: topology, recreate/run, what each of the 15 gates proves |
+| [feature-matrix.md](feature-matrix.md) | Per-feature status: VERIFIED-in-VM / VERIFIED-offline / COMPILES-untested / NOT-ENABLED |
+| [pf-guide.md](pf-guide.md) | Daily use: what works today in `/etc/pf.conf`, and the deviations to know about |
+| [screencast.md](screencast.md) | The narrated videos (English and Portuguese): phases, pipeline, how to re-record |
 | [patches.md](patches.md) | Linux core patch set (currently empty) + rules and template for future `000N-*.patch` |
 | [caveats.md](caveats.md) | Known divergences from OpenBSD behavior and current limitations |
 
@@ -27,10 +28,14 @@ authoritative references are:
 
 - `docs/superpowers/specs/2026-11-11-pf-linux-port-design.md` — design
 - `docs/superpowers/plans/2026-11-11-pf-linux-port.md` — milestone plan (tasks T1–T19)
-- `docs/porting-notes.md` — staging log + M1 deviation record (the truth about compat-layer divergences)
+- `docs/porting-notes.md` — staging log + the deviation record (the truth about compat-layer divergences)
 
 Feature-status vocabulary used across these docs:
 
-- **VERIFIED-in-VM** — exercised end-to-end in the libvirt lab (see vm-lab.md).
-- **COMPILES-untested** — the code is built into `pf.ko` but no gate has proven the behavior yet.
-- **PENDING-Mx** — lands (or lands fully) in milestone Mx; current observable behavior is documented.
+- **VERIFIED-in-VM** — exercised end-to-end in the libvirt lab; the gate that proves it is named (see [vm-lab.md](vm-lab.md)).
+- **VERIFIED-offline** — proven by a fixture or ABI test, not by traffic.
+- **COMPILES-untested** — the code is built into `pf.ko`/`pfctl` but no gate has exercised it.
+- **NOT-ENABLED** — the code exists but the feature is off in this build.
+- **OUT-OF-SCOPE** — non-goal by design (spec §3).
+
+The lab suite is **15/15 green** (`./scripts/vm-run-tests.sh`).