Boot manager: Niveus window, keys and wells, Instrument Sans, pointer, other systems, working power entries

The F8 menu is redrawn in the Niveus language: a window with three lights,
bevelled keys with a lit edge, wells for panels, anti-aliased corners and a
soft shadow, set in Instrument Sans rasterised into include/gfx/nvfont.h
(tools/python/mknvfont.py, make nvfont). Scale doubles on screens 1400 px tall
or more. Lists taller than the screen scroll.

The keyboard still drives everything, and a mouse, touchpad or tablet does
too: both UEFI pointer protocols are polled, hover moves the highlight, a
click activates. The cursor stays hidden until the pointer has really done
something, since the firmware installs a pointer protocol with or without a
mouse. The 'keep this resolution?' countdown is one ten-second budget however
many times the pointer moves.

Loaders found at well-known paths on any volume (Windows, Ubuntu, Debian,
Fedora, Arch, openSUSE, systemd-boot, rEFInd, other BOOTX64.EFI) are listed
and chain-loaded with LoadImage/StartImage. 'Reboot to firmware' used to halt;
it now sets OsIndications and restarts, and Restart and Shut Down call
ResetSystem.

Checked under QEMU+OVMF: menu, resolution list (incl. 2560x1600 at double
scale), system information, shut down, firmware setup, chain-loading a copy of
the loader from a second disk, and a full boot of the ISO to the login prompt.
Pointer hover and click were checked only with synthetic events: in this setup
a USB mouse or tablet delivered no event to the loader (one USB I/O handle
appeared but no pointer protocol came from it), and why was not established.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EVRhxi9zpdW2uDUN4FVcao

docs/plan/roadmap.md

@@ -82,15 +82,21 @@ Nothing here starts before [1.0.md](1.0.md)'s register is empty, except where th
 
 ## 5b. The boot manager
 
-The loader ([boot.md](../architecture/boot.md)) is a text menu: a splash, "Press F8", a list of options. UEFI gives much more:
-a graphics-output framebuffer at the panel's native mode, a pointer protocol, file systems to read themes from. The plan is a
-boot manager that is worth looking at — in the **Niveus / skeuomorphic** style the site and the wallpapers already use (the
-Shift mark, real materials, depth) — and usable: a mouse and keyboard, a list of what can be booted (this ISO, a SchFS
-partition, other operating systems' loaders), the options that live in the F8 menu now (resolution with its "keep this?"
-confirmation, verbose boot, drivers off), and an honest failure screen. It is its own piece of work in `boot/uefi/`
-(a small text and image renderer in the loader — the kernel's TrueType rasteriser is not available yet at that point) and it
-replaces the boot-time display handling that grew by accretion (GOP mode choice, the "keep this resolution" probe, the font scaling
-in the kernel) with one design.
+The loader ([boot.md](../architecture/boot.md#the-boot-manager)) is now a Niveus-styled window: bevelled keys, wells, Instrument Sans,
+keyboard and pointer, a list of other systems it finds on the disks and can chain-load, the F8 options (resolution with its
+"keep this?" confirmation, verbose boot), and real Firmware Setup, Restart and Shut Down.
+
+Still to do:
+
+- [ ] boot entries from a file on the ESP (several kernels, command lines, "drivers off", a default and a timeout), instead of
+      the two fixed ways of starting this system
+- [ ] a SchFS partition as a boot source, not just the volume the loader came from
+- [ ] an honest failure screen for the loader's own errors (today `die()` prints to the console)
+- [ ] the pointer path verified on a real machine; QEMU with OVMF never delivered a USB mouse event to the loader
+- [ ] light appearance, and a theme read from the ESP
+
+It is its own piece of work in `boot/uefi/`; the kernel's TrueType rasteriser is not available at that point, which is why the
+loader carries a pre-rasterised face (`include/gfx/nvfont.h`).
 
 ### The installer and `.sip`