docs: mark six deferred review findings with TODOs

Behavior untouched; each marker records a known gap and the intended
fix so the next visit doesn't rediscover it: transient zero-sent
sendmmsg errors drop a whole run; the non-vnet Poll queue lacks the
post-wake drain loop; recvmmsg controllen resets touch every entry;
cached handshake packets flush one syscall each; the routines clamp in
activate() would blackhole surplus REUSEPORT sockets if it ever became
reachable; darwin WriteBatch burst-drops on EWOULDBLOCK.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ugV2edVqoz3tBvq9J6yWp

udp/udp_linux_writebatch.go

@@ -289,6 +289,12 @@ func (w *batchWriter) WriteBatch(bufs [][]byte, addrs []netip.AddrPort, ecns []b
 				i = baseI
 				continue
 			}
+			// TODO: a transient zero-sent errno (ENOBUFS under socket-memory
+			// pressure, or a theoretical EINTR) lands here too and drops
+			// entry 0's entire run (up to 63/127 packets). The RX path
+			// retries EINTR; consider a bounded retry for those two before
+			// falling through to the per-entry drop.
+			//
 			// Any other zero-sent error is a per-entry failure:
 			// an unreachable destination, a firewall EPERM, or a PMTU shrink after a roam
 			// (EINVAL, or EMSGSIZE since kernel 6.14, once gso_size no longer fits the path).