Update boot theme

CLAUDE.md

@@ -28,6 +28,9 @@ files/etc/dot1x/                          Supplicant config + RADIUS CA (placeho
 files/etc/dracut.conf.d/90-diskless.conf  no-hostonly + drivers + modules
                                           (NM unmanaged split is now runtime:
                                           95dot1x-macsec/nm-unmanaged.sh, secure-mode only)
+files/plymouth/themes/fleet/              Custom boot splash (scripted security
+                                          checklist; driven by hook status tokens)
+files/kiosk/                              weston+Chromium kiosk + chromium lockdown policy
 scripts/extract-artifacts.sh              qcow2 -> kernel/initramfs/erofs+verity/cmdline
 scripts/build-oci.sh                      ukify + sbsign + roothash gate + OCI image
 serving/                                  Lab serving stack: dnsmasq + nginx + SPDK
@@ -149,6 +152,13 @@ instead of working around it.
   build; the supplicant config carries both options.
 - erofs module availability on the target RHEL kernel (fallback:
   journal-less ext4 in `extract-artifacts.sh`).
+- `fleet` Plymouth theme: confirm (a) the script plugin package actually
+  installed (`/usr/lib64/plymouth/script.so` — else the build fell back to
+  `spinner`, logged as a WARNING), (b) the scripted theme + a font got bundled
+  into the initramfs (`lsinitrd | grep -E 'fleet.script|script.so'`), and (c) it
+  renders (text via `Image.Text` needs the label plugin + a font in the early
+  initramfs). If blank, the splash silently no-ops but boot continues; ESC shows
+  the log. Untested in this workspace (needs a display).
 - `systemd.verity_root_options=hash-offset` is **NOT supported** by Rocky 9.8
   systemd-veritysetup (verified: "unknown option hash-offset=" → "Failed to load
   verity superblock"). Resolved by the documented fallback — data and hash are
@@ -195,14 +205,23 @@ These bit us bringing the build up on Rocky 9.8; they are easy to regress.
   stack stays in the image, dormant. The matching lab DHCP/HTTP/NVMe-oF serving
   stack lives in `serving/` (docker compose). Re-enable security by dropping the
   var / setting `DISABLE_DOT1X: "false"` in the CI workflow.
-- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for a
-  Plymouth graphical splash (theme `spinner`, set in the provisioner); `false`
-  bakes `plymouth.enable=0` for a verbose console boot — keep it OFF while
-  debugging the boot chain. Plymouth is always in the image + initramfs (the
-  `plymouth` dracut module, which pulls `drm`); only the cmdline changes. CI
-  currently sets `BOOT_SPLASH: "false"` during the network-manager bench-verify.
-  Press ESC at boot to see details behind a splash. ks.cfg no longer excludes
-  `plymouth`.
+- **Boot splash toggle**: `boot_splash=true` (default) bakes `rhgb quiet` for the
+  Plymouth splash; `false` bakes `plymouth.enable=0` for a verbose console boot —
+  keep OFF while debugging the boot chain. Plymouth is always in the image +
+  initramfs (the `plymouth` dracut module, which pulls `drm`); only the cmdline
+  changes. Press ESC at boot to see details behind a splash. ks.cfg no longer
+  excludes `plymouth`.
+- **Splash theme = custom `fleet`** (`files/plymouth/themes/fleet/`, script
+  plugin, asset-free — drawn with `Image.Text`). It renders a security-handshake
+  checklist (TPM → 802.1X → MACsec → Network → NVMe-oF) driven by best-effort
+  `plymouth update --status=<token>` calls from the dracut hooks
+  (`dot1x-macsec-up.sh`, `nvmf-connect.sh`). Tokens: `mode-test` (marks
+  auth/MACsec skipped), `tpm|dot1x|macsec|net|nvme`-`active|done`. **Rules:** the
+  emits are non-fatal (`plymouth … || true`) and must never reorder the
+  load-bearing boot sequence; show only STATES, never per-host data (invariant
+  #1). The provisioner installs the script plugin best-effort and **falls back to
+  the stock `spinner` theme** if `script.so` is absent, so a plugin-package-name
+  change can't break the build.
 
 ## Testing changes