Merge main into feat/7css-skin + give the HTML context menu an Aero skin

main retired electrobun's native context menu (a documented no-op on Linux) in
favour of an HTML one on every platform. Merging that here needs the menu to
look right under the Win7 skin as well.

Conflicts, all resolved by keeping both sides:
- src/bun/index.ts — createAppRPC keeps the branch's mainWindow getter, drops
  main's removed contextMenu dep.
- ui/src/app/app.ts — imports both TitleBar and ContextMenu.
- ui/src/app/platform.ts — kept the branch's version (its IS_MAC_CHROME accounts
  for the frameless win7 chrome, and MOD_LABEL correctly keys on the real
  platform rather than the chrome), plus exporting IS_MAC and adding IS_LINUX
  for the menu's per-OS shell wording.

Aero menu (branch-only): 7.css has no menu component, so it is hand-authored
across both layers — the row <button>s shed their push-button slab in `skin`
(revert-layer only reaches `utilities` from there), and the square-cornered
slab, hairline border and gradient selection band are stated in `skinfix`.
Built strictly from existing --w7-* vars, never literal hex, so the
hand-written dark Win7 palette recolours it for free. Hover and the keyboard
cursor share one band (the component marks the cursor with `bg-accent`, which
is overridden alongside :hover) as a real Win7 menu does.

Also answers a question the merge raised: frameless windows DO work on Linux.
The GTK wrapper honours titleBarStyle "hidden" — it calls
gtk_window_set_decorated(false) and logs "GTK: Created window without
decorations (custom titlebar)". Verified on GNOME/Wayland and documented in
architecture.md.

Verified: backend `tsc --noEmit` clean, `bun run build:ui` clean (492.52 kB
initial, still under the 500 kB budget), app launches with the skin active,
frameless, no console errors and no GBM failures.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/gotchas.md

@@ -63,7 +63,46 @@ touching the adjacent code.
 - Tray: never call `setImage` after construction on macOS — the template
   treatment is lost and the icon renders black on dark menu bars.
 - `ApplicationMenu` is macOS-only in our usage; accelerators on Windows are
-  single-character only. ContextMenu exists on macOS+Windows, not Linux.
+  single-character only.
+- **`ContextMenu.showContextMenu` is a silent no-op on Linux** (electrobun's own
+  `dist/api/bun/proc/linux.md` says so; the app also prints "Application menus are
+  not supported on Linux" at boot). Because the UI suppresses the webview's own
+  right-click menu, that left EVERY panel context menu dead on Linux — no error,
+  nothing happens. The menu is plain HTML now (`ui/src/app/context-menu.ts`) on
+  every platform; don't reintroduce the native one for "nativeness" on mac/win
+  without keeping a Linux path.
+
+## Linux
+
+- **`ERR_DLOPEN_FAILED` on `bun run start`** means a missing system library, not
+  broken app code. `libNativeWrapper.so` links `libayatana-appindicator3.so.1`
+  *hard* (for the tray), so the app cannot start at all without it — even though
+  the tray is a minor feature. Diagnose with
+  `ldd build/dev-linux-x64/*/bin/libNativeWrapper.so | grep 'not found'`; the
+  `libasar.so => not found` line in that output is a red herring (it ships beside
+  the wrapper and resolves at load). Install list per distro is in
+  [platform-notes.md](platform-notes.md).
+- **Black window on NVIDIA + `Failed to create GBM buffer of size WxH: Invalid
+  argument`** (usually with `X11 Error: GLXBadWindow (code 170)`). The app boots,
+  logs "miniSCP started", reports no error — and paints nothing. WebKitGTK's
+  DMABUF renderer can't allocate buffers on the NVIDIA proprietary driver;
+  `WEBKIT_DISABLE_DMABUF_RENDERER=1` is the upstream workaround.
+  - **The app cannot apply this to itself.** WebKit reads the variable when it
+    forks its web process, and **Bun's `process.env` writes do not propagate to
+    child processes** (verified: a spawned child sees it unset). Setting it in
+    `src/bun/index.ts` — even in a module imported before `electrobun/bun` —
+    does nothing. It must be in the environment before the app process starts.
+  - Hence every launch path injects it: `scripts/linux-gpu.ts` (`launchEnv()`)
+    for `bun run dev` / `bun run start`, and the `miniSCP.sh` wrapper that
+    `release.ts` writes beside `bin/launcher` in the tarball. **A new launch
+    path must call `launchEnv()` or it will render black on NVIDIA.**
+  - Gated on `/proc/driver/nvidia` so Intel/AMD keep hardware compositing, and
+    an explicit `WEBKIT_DISABLE_DMABUF_RENDERER` from the user always wins.
+  - A "does it boot?" log check does NOT catch this — grep for the GBM line, or
+    look at the window.
+- Benign startup noise on Linux — non-fatal, the app runs normally:
+  `libayatana-appindicator is deprecated. Please use libayatana-appindicator-glib`
+  (upstream electrobun's choice, not ours).
 - **Window-open flash prevention is three-layer** — remove any one and the
   white/inverted blink returns: (1) windows are created `hidden: true` and
   revealed by `showWhenReady` on the webview's first `dom-ready` (800 ms
@@ -122,9 +161,10 @@ touching the adjacent code.
   single-quoted entries** (`'…c'est…'`). Use double quotes for any value
   containing an apostrophe. Plurals are `{ one, other }` maps (not ICU strings);
   zh/ja supply only `other`.
-- **Native menus can't use the Angular service** — `menu.ts`/`context-menu.ts`
-  go through backend `i18n.ts`, and the app menu must be rebuilt when the locale
-  changes (wired in index.ts `settingsChanged`), or it keeps the old language.
+- **Native menus can't use the Angular service** — `menu.ts` goes through backend
+  `i18n.ts`, and the app menu must be rebuilt when the locale changes (wired in
+  index.ts `settingsChanged`), or it keeps the old language. The context menu no
+  longer has this problem: it is Angular now and reads `I18nService` directly.
 - `eu`/`zh`/`ja` are AI drafts pending native review (see the i18n README).
 - **Silent auto-refresh must snapshot sessionId+cwd and discard a mismatched
   result.** A normal `refresh()` is masked by `busy` (input blocked), but the