v3.8.0 — Limine and rEFInd restore, SELinux relabel, a tray that sees only real runs

Restore:

• Limine (CachyOS's default) and rEFInd are reinstalled by restore-rebuild-boot.sh, and a firmware boot entry is created with efibootmgr (NVRAM entries are in no backup). Written and fixture-tested only, so both rows are ❌.
• On a restored system with SELinux enforcing or permissive, the restore creates /.autorelabel. The Back In Time layer does not carry SELinux labels, and an enforcing Fedora/RHEL system with unlabeled files refuses logins. ❌ until a Fedora restore confirms it.

Verify: archives booted by Limine, rEFInd or syslinux/extlinux no longer FAIL with "no bootloader config". With the backup drive unplugged, check 1 no longer tests the root disk's keyslots and reports a false FAIL.

Tray: "backup running" is shown only when a backup actually runs, not when a shell, editor or grep command line mentions a script name. With the drive unplugged, the drive label says not connected instead of showing the root filesystem's size.

Which systems can be restored bare-metal: CONTRIBUTING.md now lists the setups that are possible but not handled yet, each with what a patch needs: ostree/transactional distros, NixOS, ZFS/bcachefs roots, mdadm RAID, syslinux/LILO, TPM2/FIDO2 LUKS, sbctl Secure Boot, non-systemd distros. It also has a Not possible section, so nobody spends time on those: Apple Silicon, ARM boards with U-Boot at raw offsets, Chromebooks, A/B image systems. For them, reinstall first, then restore over the install.