tools: preview the plymouth splash unprivileged; #137 attempt 1 reverted

Answering "how do I give you root": you don't. tools/plymouth-preview.sh
renders the splash — LUKS dialog included — into X11 windows in ~10s with
no reboot, no root and no DRM:

- unshare -rm = user + mount namespace; every mount dies with it.
- /run/plymouth is BOTH the socket dir and the compiled-in plugin path
  (`strings plymouthd` → /run/plymouth/plugins/), so we bind a writable dir
  over it AND recreate its symlinks — miss those and plymouth can't find
  x11.so, silently skips X11 and reaches for a tty.
- never pass --tty (main.c:2133 takes the X11 path only while default_tty
  is unset); /dev/dri is masked so a preview physically cannot mode-set a
  real output — which matters on a docked session (#127).
- PLY_CREATE_FAKE_MULTI_HEAD_SETUP fakes 800x600 + 640x480 heads.
- debug wants plymouth.debug=stream: — `file:` buffers and yields nothing.

What it proved immediately: with a STABLE two-head canvas the current theme
centres correctly on both heads. So the geometry is fine and #137 really is
the timing bug (positions frozen at parse time vs a canvas that resizes
when a head arrives) — recorded in the item.

And it caught my own fix: hoisting positions into layout() rendered the
background on both heads and nothing else — no logo, no bar — with NO parse
error logged. Reverted rather than shipped, because that script draws the
passphrase box on an encrypted machine. #137 carries the failure, the prime
suspect (plymouth script scope: assignment lands in `local` unless the name
already exists) and the fast edit/render loop for the next attempt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/TESTING.md

@@ -108,6 +108,19 @@ unattended env it uses is in the script, and the same flow works
 interactively from the live terminal. If the desktop comes up unthemed,
 read `/var/log/nomarchy-hm-preactivate.log` on the installed system.
 
+`tools/plymouth-preview.sh` renders the **boot splash** — including the LUKS
+password dialog — into X11 windows in about ten seconds: no reboot, no root,
+and no DRM. It runs plymouthd inside `unshare -rm` (a user + mount namespace),
+binds a writable dir over `/run/plymouth` (which is both the daemon's socket
+dir *and* its compiled-in plugin path), masks `/dev/dri` so a preview can never
+mode-set a real output, and sets `PLY_CREATE_FAKE_MULTI_HEAD_SETUP` for plymouth's
+built-in fake dual head. Pass it a theme store path to iterate on the script
+without a rebuild. Use it before touching `modules/nixos/plymouth/`: that script
+draws the passphrase box, a failure there is silent (the plugin logs
+`starting boot animation` and no error), and "type your LUKS password blind" is
+a bad way to find out. Its limit: the fake heads exist from the start, so it
+cannot reproduce a head arriving *mid-splash* (#137).
+
 Two full-desktop VM harnesses (softGL Hyprland, too heavy for `checks.*`)
 live next to the scripts: `tools/theme-shot.nix` (themed-desktop
 screenshots) and `tools/monitor-fallback.nix` (KVM display transitions: