test: the reachability check reads the USART release back too

The README says ctest reads all three hand-over properties out of the image,
and the UCSR0B clear was the one it never read. Every hand-over site must now
store zero to UCSR0B before the call; red with the write removed, green with
it. The docstring states the properties rather than the legacy bug's story.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -47,9 +47,10 @@ stopped itself on the `\n` it arrived with, one reading in.
   that bit-bangs the same pin receives perfectly and answers into nothing.
 
 `ctest` reads all three back out of the emitted image (`test/check_reachability.py`),
-because none of them is visible from the source alone and the failure mode is an
-unreflashable board. Both the address and the watchdog checks are red-proven
-against the legacy behaviour they exist to catch.
+with the image's clearance below the boot section, because none of them is
+visible from the source alone and the failure mode is an unreflashable board.
+Each is red-proven: the address and the watchdog checks against the legacy
+behaviour they exist to catch, the USART check against the write removed.
 
 The Steinhart–Hart math of the legacy firmware (runtime doubles + libm
 log) is gone: the Beta equation and the cubic fan curve are evaluated