v0.5.28 (partial): lock locale to en_US, roadmap post-install menu

Install-flow change + roadmap update. The roadmap entry is the
durable record; the code change is the immediate effect.

## Locale picker removed

The "[4/4] Locale" prompt is gone. Locale is hardcoded to en_US.UTF-8
for the install. Two reasons:

1. The picker only offered en_GB and en_US, both of which install
   identically apart from the langtag string and a couple of date /
   currency conventions that nobody who's mid-install is thinking
   about. It's a fake choice that adds a screen.
2. `localectl set-locale` post-install handles every locale on earth
   in one command. The v0.7 `veilor-postinstall` first-login menu (see
   roadmap below) will offer a locale + keyboard layout switch with
   live preview, which is the right place for that decision.

Step counters updated [1/4]→[1/3], [2/4]→[2/3], [3/4]→[3/3]. The Locale
row stays in the confirm-summary box because users still want to see
what they're getting installed.

## Roadmap

- New section v0.5.27–v0.5.28 — documents the install-path
  stabilisation work explicitly so the bridge between "first green
  ISO" and "looks polished" is not invisible. Calls out the LUKS BLS
  fix that landed in v0.5.27 + the gum-input replacement scheduled
  for v0.5.28.
- v0.6 — `veilor-doctor` description expanded: this is the
  post-install audit tool. Every user runs it weekly to see drift
  from baseline.
- v0.6 — new entry `veilor-postinstall`: EndeavourOS-style first-login
  welcome menu, single TUI screen, asks once. Covers the "I just
  installed, what do I configure" gap in one explicit step instead of
  scattered docs.

docs/ROADMAP.md

@@ -24,6 +24,30 @@ Released `v0.2.5` on 2026-05-01. CI on every push to `main`.
 
 ---
 
+## v0.5.27–v0.5.28 — install path stabilisation (active)
+
+The bridge between v0.2 (greens at all) and v0.3 (looks polished). All
+of these are install-path bugs surfaced by the formal hybrid-VM test
+procedure (`test/TESTING.md`).
+
+- **v0.5.27 (DONE)** — `rd.luks.uuid` injected via `grubby
+  --update-kernel=ALL` so Fedora 43 BLS entries actually carry the
+  arg; without it first boot drops to dracut emergency shell. GRUB
+  rebrand (single "veilor-os" entry, rescue suppressed). `fbcon=nodefer`
+  in live cmdline so real laptops don't black-screen on KMS handoff.
+  ASCII gum cursor (cosmetic only — duplicate-render bug runs deeper,
+  carried to v0.5.28).
+- **v0.5.28 (next)** — locale picker removed; en_US.UTF-8 hardcoded
+  for install (post-install menu in v0.7 handles locale switch). gum
+  input render glitches on linux fbcon (duplicate "Install", stray T
+  in password fields) get a real fix — likely replace `gum input
+  --password` with bash `read -srp`, since masked input does not need
+  TUI polish and every other distro installer does it this way.
+  Anaconda transaction containment so the user sees a branded
+  "INSTALLING" panel instead of `Configuring xxx.x86_64` scroll.
+
+---
+
 ## v0.3 — UX polish (in progress)
 
 The visible polish layer that v0.2 deferred for build velocity.
@@ -108,7 +132,18 @@ hardening.
 - **`veilor-doctor`** — diagnostic helper. Walks the audit checklist
   (`getenforce`, `mokutil --sb-state`, `firewall-cmd --get-default-zone`,
   fail2ban status, USBGuard policy, sysctl drift) and reports what's
-  drifted from baseline.
+  drifted from baseline. This is the **post-install audit** path:
+  every veilor-os user can run `veilor-doctor` weekly and see exactly
+  where their system has drifted from the hardened defaults.
+- **`veilor-postinstall`** — first-login welcome menu, EndeavourOS-style
+  but cleaner. Single TUI screen with: keyboard layout, locale, hostname
+  override, optional package presets (dev / media / homelab), driver
+  choices (NVIDIA / Intel / AMD), Bluetooth opt-in, audit baseline run.
+  Each step is skippable, runs once on first SDDM login, never auto-runs
+  again. Lives in `overlay/usr/local/bin/veilor-postinstall` + a
+  `~/.config/autostart/veilor-postinstall.desktop` that self-deletes
+  after first run. Replaces the current "user has to know what to
+  configure" model with "we ask, once, with sane defaults pre-selected".
 - **Opt-in installer ISO** — flip from live-only to live + installer,
   user picks at boot menu. Installer uses the v0.5 kickstart with full
   LUKS + btrfs subvols + zram.

overlay/usr/local/bin/veilor-installer

@@ -224,7 +224,7 @@ collect_answers() {
         prompt_error "No installable disks found."
         return 1
     fi
-    disk=$(prompt_choose_pairs "[1/4] Select install disk · WILL BE ERASED" "${disks_pairs[@]}") || return 1
+    disk=$(prompt_choose_pairs "[1/3] Select install disk · WILL BE ERASED" "${disks_pairs[@]}") || return 1
 
     # ── Hostname ──
     # Hardcoded for branded consistency. Post-install: `hostnamectl set-hostname`.
@@ -253,17 +253,21 @@ collect_answers() {
     }
 
     # ── LUKS passphrase ──
-    luks_pw=$(prompt_password "[2/4] Encryption · LUKS2 passphrase (min 8)") || return 1
+    luks_pw=$(prompt_password "[2/3] Encryption · LUKS2 passphrase (min 8)") || return 1
     validate_pw "$luks_pw" "passphrase" || return 1
 
     # ── Admin password ──
-    admin_pw=$(prompt_password "[3/4] Admin user · password for 'admin'") || return 1
+    admin_pw=$(prompt_password "[3/3] Admin user · password for 'admin'") || return 1
     validate_pw "$admin_pw" "password" || return 1
 
     # ── Locale ──
-    locale=$(prompt_choose "[4/4] Locale" \
+    # Hardcoded en_US.UTF-8 for branded consistency. The picker that
-        "en_GB.UTF-8" \
+    # used to live here (en_GB / en_US) only added confusion — both
-        "en_US.UTF-8") || return 1
+    # locales install identically, the user couldn't notice the
+    # difference, and the post-install `localectl set-locale` works for
+    # any locale anyway. v0.7 post-install menu will offer locale + kb
+    # layout switch with live preview. For the install flow, fixed.
+    locale="en_US.UTF-8"
 
     # ── Confirmation ──
     # Render summary box + danger lines via gum style, then gum confirm.