docs(agent): file #145 — show the keyboard layout on the LUKS prompt

Bernardo, and it is the right ask for this machine: a VT has one keymap and
no per-device layouts, so settings.keyboard.devices (his external board
remembered as `us`) does NOT apply at the passphrase box — it follows
xkb.layout via console.useXkbConfig. Same structural gap as #114
(tuigreet), one step earlier in the boot, with worse stakes: three wrong
tries on a disk you cannot read yet.

Fedora's mechanism does not port, twice over: its label is ply_keymap_icon,
a C widget in the two-step plugin (the script plugin has no keyboard API at
all), and it is fed from XKBLAYOUT in /etc/vconsole.conf — which NixOS does
not write. This box has only KEYMAP=<store path>, and plymouth's own trace
says `XKBLAYOUT: (null)`.

So bake it like the palette already is: @LAYOUT@ sed into nomarchy.script
from config.nomarchy.keyboard.layout, drawn with Image.Text (already used by
display_message_callback) inside display_password_callback. Label and
console keymap then come from one option in one rebuild.

Flagged for whoever takes it: keyboard.layout can be a comma list and the VT
loads the FIRST — print that, or the label lies in exactly the case it
exists for. Bundle with #137: it is one more sprite to reposition on canvas
change, and tools/plymouth-preview.sh already renders ask-for-password —
this very screen.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -177,6 +177,49 @@ migration (state.json created + git-staged, legacy `git rm`'d). Proven by
 hand 2026-07-15 (drvPaths identical across the rename) — this just keeps it
 proven. Delete together with the shim + the `nomarchy-theme-sync` alias.
 
+### 145. Show the keyboard layout on the LUKS prompt (Fedora does this)
+
+Bernardo 2026-07-16: the splash's password screen should say which layout is
+loaded. It is the right ask for this machine specifically — a VT has **one**
+keymap and no concept of per-device layouts, so `settings.keyboard.devices`
+(his external board remembered as `us`) does **not** apply at the passphrase
+box; it follows the session layout via `services.xserver.xkb.layout` →
+`console.useXkbConfig` (`modules/nixos/default.nix:96-102`). That is the same
+structural gap as **#114** (tuigreet), one step earlier in the boot, and with
+worse stakes: three wrong tries on a disk you cannot read yet, with no
+indication that the keyboard is not the one you think.
+
+**Fedora's mechanism does not port, and the reason matters.** Its label is
+`ply_keymap_icon` — a **C widget in the two-step plugin**
+(`plugins/splash/two-step/plugin.c:239`, `libply-splash-graphics/ply-keymap-icon.c`);
+the **script** plugin has no keyboard API at all (nothing in
+`script-lib-plymouth.c`). And it is fed from **`XKBLAYOUT` in
+`/etc/vconsole.conf`**, which **NixOS does not write** — this box has exactly
+`KEYMAP=/nix/store/…-xkb-console-keymap` and nothing else, so plymouth's own
+trace says `XKBLAYOUT: (null)`. Switching to a C-plugin theme *and* teaching
+NixOS to emit XKBLAYOUT to get a stock feature is a bad trade for a text label.
+
+**So bake it, the way the palette already is.** The theme derivation seds
+`@BG_R@/@BG_G@/@BG_B@` into `nomarchy.script` at build time
+(`modules/nixos/plymouth.nix`); add `@LAYOUT@` from
+`config.nomarchy.keyboard.layout` and draw it under the entry with
+`Image.Text` (already used by `display_message_callback`), in the muted/subtext
+colour, only inside `display_password_callback`. It stays honest because the
+label and the console keymap are baked from the same option in the same
+rebuild.
+
+To settle while building: (a) `keyboard.layout` may be a comma list (`us,gb`) —
+the VT loads the **first**, so print that one, not the raw string, or the label
+lies in exactly the situation it exists for; (b) wording — Fedora says
+"keyboard layout: us"; (c) whether to render it at all when there is only one
+layout and no remembered devices (an argument for always: the point is to tell
+you what the *console* does, which is not what your session does).
+
+**Do #137 first, and land this with it:** the label is one more sprite that has
+to move when the canvas resizes, so it belongs in that item's `layout()`, and
+both are proven by the same `tools/plymouth-preview.sh` run — which renders
+`ask-for-password`, i.e. exactly this screen.
+
 ### 137. Plymouth splash draws on head 0's geometry, so it is off-centre when docked
 
 Bernardo 2026-07-16 (T14s, docked): the boot **and** shutdown logo is not