Your post states that PendSV and Systick are triggered by software. While true for PendSV (and your code does it, normally this is done by ISRs serving I/O interrupts), I think that SysTick interrupts are hardware-sourced. Yes, you set up the Systick regs by software, but the event that fires the handler is a hardware one.
In case anyone is unaware, all this material, and more, is detailed in Joseph Yiu’s amazing book on Cortex-M3/4 (definitive guide, 3rd ed).