docs: name the two data-space regions a poke cannot survive

Writing 0x60-0x61 on an ATtiny13A reliably garbled the link, which looked like a
loader defect. It is the loader's own footing: .noinit lands at exactly 0x60,
size 2, and on an autobaud build that is unit_ — the measured bit period, and the
whole of its static RAM. Overwrite it and the next reply is timed against
garbage, so the symptom is a mangled prompt byte and no error, because nothing
went wrong except the rate both ends had agreed on.

Identical in kind to poking the stack at the top of SRAM, and cleared by a reset.
test/pbautobaud.py already steered its RAM round-trip clear of the bottom of SRAM
for this reason; only the README had not said it. Both regions are named there
now, beside the note that --poke does reach OSCCAL but that a session survives
only a step or two of moving the clock under itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pureboot/README.md

@@ -429,6 +429,21 @@ SRAM, and through the same address space the register file and every I/O
 register. Reading an I/O register can have side effects (reading UDR clears its
 flags), which is the caller's business to know.
 
+Reads are safe anywhere; **two small regions cannot be written without ending the
+session,** because they are what the loader is standing on:
+
+- the **top of SRAM**, where its stack lives — a handful of bytes below RAMEND;
+- on an **autobaud** build, the **two bytes at RAMSTART**: the measured bit
+  period, in `.noinit`, which is the whole of that loader's static RAM. Overwrite
+  it and its next reply is timed against garbage. On an ATtiny13A that is
+  `0x60..0x61`, and the symptom is a mangled prompt byte rather than any error —
+  the loader is fine, it simply is no longer speaking the agreed rate.
+
+Both are self-inflicted rather than defects, and a reset clears them. Note also
+that `--poke` can write OSCCAL, which does take effect — but a session can only
+survive a step or two of it before the clock walks the link out of the rate
+autobaud locked to, and OSCCAL reverts on reset regardless.
+
 Readouts come one fact per line: `--info` prints the device's version and
 signature and the geometry that follows from them, `--fuses` each fuse byte
 plus, on a boot-sectioned mega, its decoded meaning. Transfers that take wire time draw a transient progress bar on stderr