There's always some propagation delay through the flip-flop. It's often called "clock-to-Q" delay.
That means your inputs are captured on the edge, and you outputs change on the same edge, but just a few nanoseconds later. This few nanoseconds delay is enough (if your flip-flops are designed with "zero hold time" as they are in most FPGAs) that the changes don't affect any downstream flip-flops until the next clock edge.
In functional or RTL simulation (which is probably what you're doing to generate your result) the delay won't be simulated as lasting nanoseconds. In VHDL, it will be a single delta cycle of the simulator clock, which is technically no time at all. This makes it impossible to see the delay in the simulator output. Nonetheless for the simulated-as-ideal flip-flops, it is enough that the output changes don't affect downstream flip-flops.
If you do post-place-and-route simulation, it should be able to include appropriate delays so you see these effects clearly, at the cost of increased simulation effort.
As far as I can tell, you're doing everything right.
If this were sitting on my workbench, here's the next thing I would do:
On production units, I would make the resistor on MISO a pull-up, rather than a pull-down.
Page 37 of the datasheet only guarantees 100 uA on "MISO out high", but over 10 times that current on "MISO out low".
The 1.6 mA on "MISO out low" is enough to (dimly) light a high-efficiency LED with an appropriate pull-up resistor to +3.3 V.
I find adding LEDs to every questionable signal helps me find problems faster.
The 100 uA on "MISO out high" means don't expect the flash chip to work with a pull-down of 33 KOhm or less.
On my test jig (but not on production units), I would temporarily change resistor on MISO changed to weakly pull MISO to around 1.5 V -- that helps distinguish between high (near 3.3 V), low (near 0 V), and tristate (near 1.5 V).
I would re-run the test and make sure the only thing connected to MISO is the o'scope (or logic analyzer) probe and that bias resistor -- not even the PIC connected -- to rule out the possibility that the PIC is somehow accidentally driving MISO to GND.
I would make a custom test program on the PIC that does nothing but select the flash chip, attempt a READ IDENTIFICATION and reads 20 bytes, then deselects the flash chip, and then repeats forever. (It looks like maybe you've already done this).
It's theoretically possible that a PIC chip could be damaged just enough that it gives signals barely strong enough for the logic analyzer to distinguish "0" from "1", but not quite strong enough for the flash chip to distinguish them.
So I might check the voltages by (a) tweaking the custom test program so it runs the CLK at 1 Hz, so I can check each line on the flash chip with a voltmeter, or (b) running the test program at a more typical speed -- 500 KHz or 10 MHz should work fine -- and check each pin with an actual o'scope (not just a logic analyzer).
It's pretty easy to destroy a flash chip so it looks fine under visual inspection, but damaged such that now it won't ever work (always tri-state or always outputs 0).
Perhaps swap the flash chip with an "identical" M25P16 chip on something like the JeeLink and see if the problem follows the flash chip or stays with the PIC chip.
Perhaps re-build the entire circuit with fresh wires, a fresh PIC chip, and a fresh flash chip, and swap the chips around to see if the problem follows the PIC chip, follows the flash chip, or follows the prototype wires.
Best Answer
SPI buses are frequently shared with multiple devices. So the clock might be running while device A is deselected, because another device B is selected.
The timing constraint tCHSL described is the time S# must be held high after a rising clock edge. This might happen if devices are rapidly switched. If this constraint is broken, device A might behave as if the last clock edge for device B was directed towards itself or generally experience undefined. It's a pretty unlikely case and most datasheets will have only a required S# low to CLK rising setup timing constraint instead with the implicit assumption that this edge case is averted by the SPI protocol itself though proper S# hold time tCHSH after the last clock edge of device B.