Docs: bring the documentation in line with the code

- Demo docs replaced by the screencast docs (single source of truth): the
  legacy demo-session.sh/demo-record.py and the v0.9 renderer were removed
  instead of being kept as a second convention.
- feature-matrix: stale 'M2-in-progress' vocabulary gone; the rows the 15
  gates prove now say VERIFIED-in-VM and name the gate; af-to is now an
  explicit non-goal row (INET6 0 in this build).
- guide: the queues/divert/pflog sections described a state that no longer
  exists (priq-only, divert dropping packets, pflog logging nothing); they
  now describe the shipped behaviour.
- vm-lab: the 15 real gates with what each proves, 15/15 green, and the
  pf0 -> cli/srv/gw2 ssh setup the screencasts rely on.
- install/build: pdivert and pflogd are built and ported (docs said
  otherwise); module object list now includes hfsc.c, fq_codel.c, pfk_pflog.c;
  the screencast pipeline is an optional build stage.
- pf-guide: the 'M2 scope only' framing is gone; honest gaps listed.
- caveats: three new sections about the screencast pipeline (MiniMax video
  generation blocked by the account tier, narration as a separate track, a
  video frame is not a verdict).
- porting-notes: what the recording taught us.
- README/README.pt-BR: status, milestones, layout and video section updated.

All internal doc links verified.

docs/pt-BR/demo.md

@@ -1,40 +0,0 @@
-# Demo (asciinema)
-
-O lab pode ser gravado como um cast do [asciinema](https://asciinema.org).
-Cada byte da gravação é a saída real das VMs do lab (Alpine sobre libvirt,
-rodando o kernel compilado do fonte com o `pf.ko`); só o ritmo é roteirizado.
-
-## Gravar
-
-```sh
-pip install asciinema            # uma vez
-bash scripts/vm-run-tests.sh      # ou: scripts/vm-create.sh + deploy
-asciinema rec out/demo-pf-linux.cast -c "bash scripts/demo-session.sh"
-```
-
-A sessão percorre:
-
-1. a topologia do lab e o `pf.ko` recém-carregado (prova no `dmesg`),
-2. `pfctl -s info` pela ABI de ioctl do OpenBSD,
-3. um `pf.conf` real (tabela, regras stateful, drop explícito) e `pfctl -sr`,
-4. ping em trânsito + `pfctl -ss` (stateful),
-5. `pfctl -t <tabela> -T show` (tabelas vivas),
-6. um ping bloqueado (contadores com `pfctl -sr -vv`),
-7. `divert-to` com o relay `pdivert` (pacote vai ao userspace e volta),
-8. desligamento.
-
-## Reproduzir
-
-```sh
-asciinema play out/demo-pf-linux.cast
-```
-
-## Publicar
-
-```sh
-asciinema upload out/demo-pf-linux.cast
-```
-
-`scripts/demo-record.py` é um gravador alternativo que produz o mesmo formato
-asciicast v2 sem o binário asciinema (ele conduz o lab por ssh e escreve o
-cast diretamente).