docs: M1-16 Path B design doc (real-mode-first BIOS I/O)

Superseding the Path A "debug the call_bios_int trampoline"
approach — which hit the kill-criteria in an earlier session —
with Path B: do all BIOS I/O in real mode BEFORE the CR0.PE
transition, buffer E820 / partition table / config / kernel at
fixed physical addresses, then switch to protected mode exactly
once with the guarantee that kmain never needs BIOS again.

Matches Limine's own stage3 structure and eliminates the entire
class of bugs the 32→real→32 trampoline produced.

Doc covers:

- Memory map + unreal-mode setup for kernels above 1 MiB.
- `BootDataBundle` handoff struct at fixed phys 0x01000.
- Real-mode I/O wrappers (INT 13h ext-read, INT 15h E820, INT
  10h VBE 3.0) as `global_asm!` extern "C" functions callable
  from Rust-in-real-mode.
- Minimal real-mode FAT32 loader (MBR part-table → BPB → root
  directory → FAT cluster chain → `rep movsb fs:[edi]` to high
  memory).
- 7 phases (scaffolding → I/O wrappers → unreal mode → FAT32 →
  orchestration → kmain collapse → re-enable bios-boot-smoke).
- Risk table + kill criteria (7-day timebox → fall back to
  fixed-kernel / fixed-LBA MVP or drop BIOS from v1.0).
- File-change estimate (~+1000 / ~−650 lines).

Intended as a working document: delete in the same commit that
flips M1-16 to `[✓]` in TODO.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: UnbreakableMJ