Firmware README: complete the patched-image inventory (speed ladder, e0t5)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -50,3 +50,13 @@ widen its window, burn a new EPROM, keep this original safe.
   sha256 `9f866cf353d04906e1d3e3847b6375eaae251c987b656f68f093e61ba1bd545b`.
   Bench/RIOJoy-only until the native games get baud patches; needs an
   FTDI-class adapter (16550s can't make 31250). Test tools take `--baud 31250`.
+- **Speed-ladder variants** (`_31250v2`, `_62500`, `_125000`) and bench
+  verdicts: see RIOv4_2-ANALYSIS.md — 31250v2 is the certified FastRIO
+  build; 62500/125000 were science runs (CPU is the wall).
+- **`RIOv4_2_patched_e0t5.bin` / `RIOv4_2_patched_31250v2_e0t5.bin`**
+  (`--e0thresh=5`) — adds a threshold to the cockpit display's `E0`
+  serial-error readout, which stock firmware paints on the *first*
+  counter event (`E0000001` forever after one benign give-up). Display
+  stays `F0000000` until any error counter reaches 5; counters still
+  accumulate. 30-byte cave at `$E000`, disassembly-verified, **not yet
+  burned/bench-verified**. Details in RIOv4_2-ANALYSIS.md.