docs: mark rumble TX verified on hardware

Rumble works from the Rumble button in the app; Phase 3 is complete.
Next up is Phase 4 (virtual HID gamepad).

Co-Authored-By: qwen3.8-27b@q3_k_xl: marked rumble verified

README.md

@@ -89,10 +89,10 @@ Strike through or check off as each is resolved.
 - [x] **Frame encapsulation**: Resolved: TX/RX chip headers handled per the
       Linux driver (`send_wlan` / `process_wlan`). Association, pairing, and
       encryption-enable management frames verified against hardware.
-- [ ] **QoS data frames**: RX path verified: controller input QoS frames are
+- [x] **QoS data frames**: RX path verified: controller input QoS frames are
       decrypted, fed to the GIP layer, and shown live in the app. Host to
-      controller TX (rumble) is implemented via the app's Rumble button,
-      pending hardware verification.
+      controller TX (rumble) verified on hardware via the app's Rumble
+      button.
 
 ### 5. AES-CCMP Encryption